In the second timeline of December 2024, I collected 94 events (6.27 events/day) with a threat landscape dominated by malware with 33%, up from 31% of the previous timeline, ahead of account takeovers with 20%, and targeted attacks down to 11% from 16% of the previous fortnight.
In terms of initial access, phishing emails were still the preferred weapon with 20%, slightly up from 15%, ahead of supply chain compromises with 16%, a sharp increase compared to 6% of the previous timeline, and malvertising with 7.6%.
Cyber crime led the motivations chart with 76%, up from 66% of the previous timeline, as usual ahead of cyber espionage (12% down from 20%), and hacktivism with 4%. In the second half of December, no events related to cyber warfare were recorded.
Multiple organizations led the sectors chart with 28%, down from 32%, ahead of governments with 10%, slightly down from 11% up from 9.2% and fintech, which reaches the top three with 8%.
Besides these trends, as always the timeline is rich of interesting events, such as mega breaches (now the corresponding piost is updated with the events occurred in 2024) and attacks against organizations in the fintech space, so my final suggestion does not change: browse the timeline for the details of the events collected in this fortnight.
Feel free to share it to support my work and spread the risk awareness across the community. And last but not least, don’t forget to connect on Linkedin, or even follow @paulsparrows on X (formerly Twitter), psparrows.bsky.social on Bluesky, or @ppasseri@Infosec.exchange on Mastodon for the latest updates.
Geo Map December H2 2024
No Data Found
No Data Found
BE NOTIFIED OF NEW POSTS
SUPPORT MY WORK! MAKE A DONATION
Creating the timelines is a very time-consuming task.
In this first quarter of 2024, threat actors have been particularly busy in exploiting vulnerabilities (0-days but also old unpatched flaws) targeting traditional remote access technologies.
A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
A live, continuously updated timeline of the cyber attacks reported in September 2026 — tracking threat actors, attack techniques, targeted sectors and countries as each incident is vetted and added.
Finally I can summarize all the events and statistics collected in 2018, quite a complicated year from an infosec perspective. For those of you that keep asking...
A one-page visual briefing on August 2026's global cyber attack landscape: 218 confirmed incidents, a rising four-in-five share driven by profit-motivated crime, and a back-to-back spike that delivered 34 attacks in just two days.
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information
The Texas Tech University Health Sciences Center and its El Paso counterpart suffer a cyberattack that disrupted computer systems and applications, potentially exposing the data of 1.4 million patients.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
2
16/12/2024
During H2 2024
During H2 2024
?
Individuals
Researchers at ESET reveal the details of Nomani, a new kind of investment scam that leverages a combination of social media malvertising, company-branded posts, and artificial intelligence (AI) powered video testimonials featuring famous personalities, ultimately leading to financial and data loss.
Scam
Individual
Cyber Crime
>1
Social Engineering
3
16/12/2024
-
-
Unknown threat actors
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) warns d U.S. federal agencies to secure their systems against ongoing attacks targeting CVE-2024-35250, a high-severity Windows kernel vulnerability.
Unknown
Unknown
Unknown
US
OS Vulnerability
4
16/12/2024
-
-
Unknown threat actors
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) adds CVE-2024-20767, a critical Adobe ColdFusion Vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
Public-facing App Vulnerability
5
16/12/2024
'For several weeks'
'For several weeks'
Vane Viper
Individuals
Researchers at Guardio Labs and Infoblox discover DeceptionAds, a large-scale malvertising campaign distributing the Lumma Stealer malware through fake CAPTCHA verification pages. The campaign leverages the Monetag ad network to propagate over one million ad impressions daily across three thousand websites, and is believed to be conducted by the threat actor known as "Vane Viper."
Malware
Individual
Cyber Crime
>1
Malvertising
6
16/12/2024
Since at least February 2024
Since at least February 2024
Serbian Government
Activists, journalists, and protestors in Serbia
A report by Amnesty International reveals that the Serbian government exploited CVE-2024-43047, a Qualcomm zero-days to unlock and infect Android devices with a new spyware named 'NoviSpy,' used to spy on activists, journalists, and protestors.
Malware
Individual
Cyber Espionage
RS
OS Vulnerability
7
16/12/2024
-
-
?
Businesses and individuals in marketing, sales, and executive positions
Researchers at CloudSEK disclose details of an advanced new phishing campaign targeting YouTube creators.
Malware
Multiple Industries
Cyber Crime
>1
Phishing Email
8
16/12/2024
Since at least March 2024
During March 2024
?
Multiple organizations
The FBI warns that new HiatusRAT malware attacks are now scanning for and infecting vulnerable web cameras and DVRs that are exposed online.
Malware
Multiple Industries
Cyber Crime
AU
CA
GB
NZ
US
IoT Vulnerability
9
16/12/2024
Since at least October 2024
During October 2024
?
Multiple organizations
Researchers from Zscaler discover a new malware family dubbed Riseloader.
Malware
Multiple Industries
Cyber Crime
>1
Unknown
10
16/12/2024
-
-
?
Multiple organizations
Researchers from Morphisec reveal the details of a campaign delivering the CoinLurker malware.
Malware
Multiple Industries
Cyber Crime
>1
Rogue App
Malvertising
Phishing Email
Fake CAPTCHA Prompts
Rogue Website
Social Media
11
16/12/2024
Since at least 19/11/2024
19/11/2024
?
Multiple organizations
Researchers from G Data discover a new malware family dubbed I2PRAT that abuses the I2P peer-to-peer network for encrypted communications with a command-and-control (C2) server.
Malware
Multiple Industries
Cyber Crime
>1
Phishing Email
12
16/12/2024
Since at least 16/12/2024
16/12/2024
?
Ledge users
A new Ledger phishing campaign pretends to be a data breach notification asking victims to verify their recovery phrase, which is then stolen and used to steal cryptocurrency.
Account Takeover
Fintech
Cyber Crime
>1
Phishing Email
13
16/12/2024
06/12/2024
06/12/2024
Holy League
French Governmental and Critical Infrastructure
The hacktivist collective Holy League launches a DDoS campaign against French governmental and critical infrastructure.
DDoS
Public admin and defence, social security
Hacktivism
FR
N/A
14
16/12/2024
14/12/2024
14/12/2024
Holy League
Undisclosed Targets in Germany
The hacktivist collective Holy League launches a DDoS campaign against undisclosed targets in Germany.
DDoS
Unknown
Hacktivism
DE
N/A
15
16/12/2024
-
18/09/2024
?
Regional Care
Nebraska-based healthcare insurance firm Regional Care discloses a data breach impacting more than 225,000 individuals as a result of an incident identified in mid-September 2024.
Unknown
Education
Cyber Crime
US
Unknown
16
16/12/2024
-
15/12/2024
Cicada3301
Concession Peugeot
Cicada3301 ransomware group claims responsibility for a data breach targeting Concession Peugeot (concessions.peugeot.fr), a prominent French automotive dealership linked to the Peugeot brand. The group claims to have stolen 35GB of sensitive data
Ransomware
Wholesale and retail
Cyber Crime
FR
Unknown
17
16/12/2024
During October 2023 and February 2024
-
?
Crypto Users
The threat actors behind the 2022 LastPass breach were able to steal an estimated $5.36 million in crypto assets from over 40 wallet addresses. The wave of attacks is said to have originated from the 2022 incident in the password manager service LastPass.
Account Takeover
Fintech
Cyber Crime
>1
Supply Chain Compromise
18
17/12/2024
-
-
Hunters International
Namibia Telecom
Namibia Telecom is hit with a ransomware attack by the Hunters International gang.
Ransomware
Information and communication
Cyber Crime
NA
Unknown
19
17/12/2024
18/11/2024
18/11/2024
TA397 a.k.a. Bitter
Defense sector organization in Turkey
Researchers at Proofpoint discover a sophisticated phishing attack targeting a Turkish defense sector organization via the MiyaRAT, carried out by the threat actor TA397, a.k.a. Bitter, using a Madagascar lure, and delivering malware through advanced mechanisms involving NTFS Alternate Data Streams (ADS) and scheduled tasks.
Targeted Attack
Public admin and defence, social security
Cyber Espionage
TR
Phishing Email
20
17/12/2024
Since mid-November 2024
Since mid-November 2024
?
Multiple organizations, including education, healthcare services, building companies, and banks
Researchers from Check Point reveal the details of an ongoing phishing scam, abusing Google Calendar invites and Google Drawings pages to steal credentials while bypassing spam filters, and targeting 300 brands with over 4,000 emails sent in four weeks.
Account Takeover
Multiple Industries
Cyber Crime
>1
Phishing Email
21
17/12/2024
-
-
?
Multiple Organizations
Researchers at ANY.RUN reveals the details of Nova, a newly discovered fork of the Snake Keylogger family.
Malware
Multiple Industries
Cyber Crime
>1
Phishing Email
22
17/12/2024
Since 07/08/2024
During October 2024
APT29 (a.k.a. Midnight Blizzard, Earth Koshchei)
Governments and armed forces, think tanks, academic researchers, and Ukrainian entities
Researchers at Trend Micro reveal the details of a campaign carried out by the Russia-linked APT29 threat actor, leveraging malicious Remote Desktop Protocol (RDP) configuration files.
Targeted Attack
Multiple Industries
Cyber Espionage
UA
Other Countries
Phishing Email
23
17/12/2024
During November 2024
During November 2024
?
Multiple Organizations in Pakistan
Researchers at Securonix reveal the details of. FLUX#CONSOLE, a new phishing campaign employing tax-themed lures to deliver a stealthy backdoor payload as part of attacks targeting Pakistan.
Malware
Multiple Industries
Cyber Crime
PK
Phishing Email
24
17/12/2024
Since 11/12/2024
11/12/2024
?
Multiple Organizations
Researchers at Juniper reveal that a specific line of Juniper Networks devices can easily become infected with Mirai malware if users don't change their default passwords.
Malware
Multiple Industries
Cyber Crime
>1
Misconfiguration
25
17/12/2024
'Recently'
'Recently'
Diicot a.k.a. Mexals
Multiple Organizations
Researchers at Wiz discover a new malware campaign attributed to the Romanian-speaking Diicot threat group, targeting Linux-based machines running OpenSSH, exploiting weak credentials to gain access.
Malware
Multiple Industries
Cyber Crime
>1
Misconfiguration
26
17/12/2024
-
-
?
Multiple Organizations
Researchers at BitSight reveal that the BadBox Android malware botnet has grown to over 192,000 infected devices worldwide despite a recent sinkhole operation that attempted to disrupt the operation in Germany, now infecting more well-known and trusted brands like Yandex TVs and Hisense smartphones.
Malware
Multiple Industries
Cyber Crime
>1
IoT Vulnerability
27
17/12/2024
17/12/2024
17/12/2024
?
Gem Pad
The Gem Pad token launchpad is exploited for an estimated loss of $2.2M in crypto assets.
Unknown
Fintech
Cyber Crime
N/A
Software Vulnerability
28
18/12/2024
Since June 2024
September 2024
?
Organizations in the automotive, chemical, and industrial manufacturing
Researchers at Palo Alto Networks discover a phishing campaign targeting European companies, including in Germany and the UK, aimed to exploit HubSpot to harvest account credentials and take over the victim’s Microsoft Azure cloud infrastructure.
Account Takeover
Multiple Industries
Cyber Crime
DE
GB
Phishing Email
29
18/12/2024
Earlier in December 2024
Earlier in December 2024
?
Multiple Organizations
Researchers at Sonatype discover a campaign where threat actors are observed uploading malicious typosquats of legitimate npm packages such as typescript-eslint and @types/node collecting thousands of downloads on the package registry.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
30
18/12/2024
'Recently'
'Recently'
?
Android users
Researchers at McAfee discover a malicious Android spyware application named 'BMI CalculationVsn' on the Amazon Appstore, masquerading as a simple health tool but stealing data from infected devices in the background.
Malware
Individual
Cyber Crime
>1
Supply Chain Compromise
31
18/12/2024
17/12/2024
17/12/2024
UAC-0125 linked to UAC-0002, a.k.a. APT44, FROZENBARENTS, Sandworm, Seashell Blizzard, and Voodoo Bear
Military personnel in Ukraine
The Computer Emergency Response Team of Ukraine (CERT-UA) discloses that a threat actor tracked as UAC-0125 is leveraging Cloudflare Workers to trick military personnel in the country into downloading malware disguised as Army+, a mobile app that was introduced by the Ministry of Defence back in August 2024 in an effort to make the armed forces go paperless.
Targeted Attack
Public admin and defence, social security
Cyber Espionage
UA
Rogue Website
32
18/12/2024
During December 2024
During December 2024
“k303903”
npm developers
Researchers at Sockey identify a malware campaign infiltrating the npm ecosystem, deploying the Skuld infostealer through malicious packages — windows-confirm, windows-version-check, downloadsolara, and solara-config — disguised as legitimate tools.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
33
18/12/2024
'Recently'
'Recently'
?
Multiple Organizations
Researchers at Zimperium uncover a spear phishing campaign targeting executives, using a mimicked legitimate DocuSign document requiring immediate review.
Account Takeover
Multiple Industries
Cyber Crime
>1
Phishing Email
34
18/12/2024
06/05/2024
06/05/2024
?
Adam Griffin
Adam Griffin, a crypto investor is robbed of nearly $500,000 in cryptocurrencies after a scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him to click “yes” to a Google prompt on his mobile device.
Account Takeover
Fintech
Cyber Crime
US
Social Engineering
35
18/12/2024
During May 2024
During May 2024
?
"Tony" (undisclosed crypto investor)
A scammer impersonating Google manages to phish 45 bitcoins — approximately $4,725,000 at today’s value — from Tony, a 42-year-old professional from northern California.
Account Takeover
Fintech
Cyber Crime
US
Social Engineering
36
18/12/2024
-
-
?
Individuals
Researchers at Malwarebytes discover a campaign targeting users searching the Internet for the Securitas OneID mobile app via bogus pages with AI-generated content.
Account Takeover
Individual
Cyber Crime
>1
Malvertising
37
18/12/2024
-
-
?
Individuals
Researchers at Malwarebytes discover a campaign targeting users searching the Internet for the Parsec remote desktop app, via bogus pages with AI-generated content.
Account Takeover
Individual
Cyber Crime
>1
Malvertising
38
19/12/2024
During October 2024
During October 2024
Lazarus Group
Unnamed nuclear-related organization
Researchers at Kaspersky reveal that the Lazarus Group, the threat actor linked to the Democratic People's Republic of Korea (DPRK), has been observed leveraging a "complex infection chain" targeting at least two employees belonging to an unnamed nuclear-related organization. The attacks, part of Operation Dream Job, culminated in the deployment of a new modular backdoor referred to as CookiePlus,
Targeted Attack
Electricity, gas steam, air conditioning
Cyber Espionage
Unknown
Unknown
39
19/12/2024
-
19/12/2024
?
Multiple Organizations
The developers of Rspack reveal that two of their npm packages, @rspack/core and @rspack/cli, were compromised in a software supply chain attack that allowed a malicious actor to publish malicious versions to the official package registry with cryptocurrency mining malware.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
40
19/12/2024
'Recently'
'Recently'
?
Multiple Organizations
Researchers at Silent Push discover that the Araneida Scanner – which appears to be based in part on a cracked version of Acunetix, a popular web app vulnerability testing tool – is being used by threat actors for illegal purposes.
Multiple Attack Vectors
Multiple Industries
Cyber Crime
>1
Misconfiguration
41
19/12/2024
-
-
Threat Actor from Vietnam
Undisclosed organization in the education sector in Malaysia
Researchers from Trend Micro discover a Python-Based NodeStealer version targeting Facebook Ads Manager.
Malware
Education
Cyber Crime
MY
Phishing Email
42
19/12/2024
SInce October 2024
During mid-November 2024
?
Multiple Organizations
Researchers at Akamai discover a new Mirai-based botnet, called “Hail Cock Botnet”, actively exploiting an unparched remote code execution vulnerability in DigiEver DS-2105 Pro NVRs.
Malware
Multiple Industries
Cyber Crime
>1
IoT Vulnerability
43
19/12/2024
-
-
?
Individuals
Researchers at Malwarebytes discover a malicious campaign using a combination of malicious ads and decoy pages for software brands, followed by a fake Cloudflare notification that instructs users to manually run a few key combinations to execute PowerShell code that retrieves and installs malware.
Malware
Individual
Cyber Crime
>1
Malvertising
44
19/12/2024
Since Early October 2024
Since Early October 2024
?
Automotive, manufacturing, medical, construction, consulting, and entertainment industries.
Researchers at TRAC identify a phishing kit, named WikiKit because of its functionality to redirect to Wikipedia pages if the JavaScript is disabled or the phishing link is invalid.
Account Takeover
Multiple Industries
Cyber Crime
>1
Phishing Email
45
19/12/2024
-
-
?
Multiple Organizations
Researchers at Sophos discover a new Microsoft 365 phishing-as-a-service platform called "FlowerStorm", growing in popularity, and filling the void left behind by the sudden shutdown of the Rockstar2FA cybercrime service.
Account Takeover
Multiple Industries
Cyber Crime
>1
Unknown
46
19/12/2024
19/12/2024
19/12/2024
XakNet
Ukrainian State Registers
Suspected Russian threat actors from the XakNet collective launch one of the largest cyberattacks on Ukraine’s state services in recent months.
DDoS
Public admin and defence, social security
Hacktivism
UA
N/A
47
19/12/2024
-
-
Unknown threat actors
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds the CVE-2024-12356 vulnerability impacting BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Public admin and defence, social security
Unknown
US
Security Appliance Vulnerability
48
19/12/2024
During October 2024
During October 2024
?
Undisclosed Organization
Researchers from Kaspersky reveal that CVE-2023-48788, a now-patched critical security flaw impacting Fortinet FortiClient EMS is being exploited by malicious actors as part of a cyber campaign that installed remote desktop software such as AnyDesk and ScreenConnect.
Unknown
Unknown
Unknown
Unknown
Security Appliance Vulnerability
49
20/12/2024
Since Early October 2024
Since Early October 2024
?
Developers and cryptocurrency projects
Researchers at ReversingLabs discover several malicious extensions in the npm package repository, which were initially detected in the Visual Studio Code (VSCode) Marketplace.
Malware
Fintech
Cyber Crime
>1
Supply Chain Compromise
50
20/12/2024
19/12/2024
19/12/2024
?
Multiple Organizations
Researchers at Sonatype reveal that the supply chain attack targeting Rspack is also said to have targeted another npm package named vant.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
51
20/12/2024
SInce October 2024
During October
?
Multiple Organizations
Researchers at Hunt.io discover a notable large-scale threat campaign, dubbed "LummApp," targeting users and organizations through a combination of advanced adware and infostealing techniques disguised as a benign application.
Malware
Multiple Industries
Cyber Crime
>1
Rogue App
52
20/12/2024
18/12/2024
18/12/2024
“solidit-dev-416”
Multiple Organizations
Researchers at Socket discover a malicious package on the npm package registry that masquerades as a library for detecting vulnerabilities in Ethereum smart contracts but, in reality, drops the open-source remote access trojan called Quasar RAT onto developer systems.
Malware
Fintech
Cyber Crime
>1
Supply Chain Compromise
53
20/12/2024
'Recently'
'Recently'
Charming Kitten
Undisclosed Organization in Asia
Researchers from Kaspersky observe the Iran-linked APT group Charming Kitten using a new variant of the BellaCiao malware dubbed BellaCPP.
Targeted Attack
Unknown
Cyber Espionage
Unknown
Unknown
54
20/12/2024
25/04/2024
25/04/2024
?
Illinois Department Of Human Services
The Illinois Department Of Human Services reveals that a phishing attack affected more than 1.1M public assistance clients.
Account Takeover
Human health and social work
Cyber Crime
US
Unknown
55
20/12/2024
19/12/2024
19/12/2024
?
Boone County School District
Personal data from current and former students in Boone County School District are compromised in a phishing scheme.
Account Takeover
Education
Cyber Crime
US
Phishing Email
56
20/12/2024
27/11/2024
04/12/2024
?
Kenton County School District
Personal data from current and former students in Kenton County School District are compromised in a phishing scheme.
Account Takeover
Education
Cyber Crime
US
Phishing Email
57
23/12/2024
-
-
Unknown threat actors
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds an Acclaim Systems USAHERDS vulnerability, tracked as CVE-2021-44207 to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Public admin and defence, social security
Unknown
US
Public-facing App Vulnerability
58
23/12/2024
SInce at least 16/11/2024
16/11/2024 and 24/11/2024
?
Multiple Organizations
Researchers at Fortinet identify Python malware in two malicious Python packages, Zebo-0.1.0 and Cometlogger-0.1, targeting unsuspecting users for their data.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
59
23/12/2024
23/12/2024
23/12/2024
?
European Space Agency
The European Space Agency's official web shop is hacked as it started to load a piece of JavaScript code that generates a fake Stripe payment page at checkout.
Malicious Script Injection
Extraterritorial orgs and bodies
Cyber Espionage
EU
Public-facing App Vulnerability
60
23/12/2024
19/12/2024
19/12/2024
?
Pittsburgh Regional Transit
Pittsburgh Regional Transit (PRT) is hit with a ransomware attack.
Ransomware
Transportation and storage
Cyber Crime
US
Unknown
61
23/12/2024
23/09/2024
22/11/2024
?
American Addiction Centers
A ransomware attack on American Addiction Centers exposes the sensitive healthcare information of more than 400,000 people. The Rhysida ransomware gang claims responsibility for the attack.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
62
23/12/2024
10/10/2024
01/10/2024
?
General Dynamics
Aerospace and defense giant General Dynamics says threat actors compromised dozens of employee benefits accounts after a successful phishing campaign targeting its personnel.
Account Takeover
Professional, scientific and technical
Cyber Crime
US
Malvertising
63
23/12/2024
During 2024
During 2024
Cloud Atlas (a.k.a. Clean Ursa, Inception, Oxygen, and Red October)
Multiple Organizations
Researchers at Kaspersky reveal that the threat actor known as Cloud Atlas has been observed using a previously undocumented malware called VBCloud as part of its cyber attack campaigns targeting "several dozen users" in 2024.
Malware
Multiple Industries
Unknown
BY
CA
IL
KG
MD
RU
TR
VN
Phishing Email
64
24/12/2024
06/05/2024
06/05/2024
?
Richmond University Medical Center
The Richmond University Medical Center in New York is investigating a ransomware attack since May 2023 and it recently determined that the incident resulted in a data breach affecting more than 670,000 people.
Ransomware
Education
Cyber Crime
US
Unknown
65
24/12/2024
-
-
?
Multiple Organizations
Researchers at Google discover a new malware called PLAYFULGHOST that comes with a wide range of information-gathering features like keylogging, screen capture, audio capture, remote shell, and file transfer/execution.
Malware
Multiple Industries
Cyber Crime
>1
Malvertising
Phishing Email
66
24/12/2024
During June 2024
During June 2024
?
Allendale Long-Term Care Home
A cybersecurity incident involving third-party software at Allendale Long-Term Care Home in Milton exposes personal electronic health records from 2005 to this summer.
Unknown
Human health and social work
Cyber Crime
CA
Supply Chain Compromise
67
24/12/2024
During December 2024
During December 2024
“0mid16B”
ArdyssLife
The threat actor known as 0mid16B claims to have successfully attacked Ardyss[.]com and ArdyssLife[.]com, stealin 596 GB of data from United States ArdyssLife[.]com and Ardyss[.]com server network.
Ransomware
Wholesale and retail
Cyber Crime
US
Public-facing App Vulnerability
68
24/12/2024
-
-
UNC5325
Undisclosed Organization(s)
Researchers at Northwave reveal that UNC5325, a suspected Chinese threat actor, is exploiting CVE-2024-9474, a vulnerability in Palo Alto firewalls, to install custom malware backdoor for espionage.
Targeted Attack
Unknown
Cyber Espionage
Unknown
Supply Chain Compromise
69
25/12/2024
'Recently'
'Recently'
?
Multiple Organizations
Researchers from NTT Japan discover that North Korean threat actors are using new malware called OtterCookie in the Contagious Interview campaign that is targeting software developers.
Targeted Attack
Multiple Industries
Cyber Espionage
>1
Social Engineering
70
25/12/2024
-
-
Paper Werewolf (a.k.a. GOFFEE)
Government, energy, financial, media, and other organizations in Russia
Researchers at BI.ZONE record a surge in the activity of the Paper Werewolf cluster (also known as GOFFEE), which has conducted at least seven campaigns since 2022. Among the victims are government, energy, financial, media, and other organizations.
Targeted Attack
Multiple Industries
Cyber Espionage
RU
Phishing Email
71
26/12/2024
-
-
?
Banking users in Russia
Researchers at Doctor Web identify a new wave of attacks involving the NGate banking trojan, now targeting Russian users.
Malware
Finance and insurance
Cyber Crime
RU
Social Engineering
72
26/12/2024
26/10/2024
08/11/2024
?
ZAGG
ZAGG informs customers that their credit card data has been exposed to unauthorized individuals after hackers compromised a third-party application provided by the company's e-commerce provider, BigCommerce.
Malicious Script Injection
Manufacturing
Cyber Crime
US
Supply Chain Compromise
73
26/12/2024
During October and November 2024
During October and November 2024
?
Multiple Organizations
Researchers at Fortinet reveal that two botnets tracked as ‘Ficora’ and ‘Capsaicin’ have recorded increased activity in targeting D-Link routers that have reached end of life or are running outdated firmware versions, using known exploits for CVE-2015-2051, CVE-2019-10891, CVE-2022-37056, and CVE-2024-33112.
Malware
Multiple Industries
Cyber Crime
>1
Hardware Vulnerability
74
26/12/2024
25/12/2024
25/12/2024
“h4xx0r1337″
Mi Argentina
The Mi Argentina site and the SUBE card app, two of the government’s most important digital platforms, suffer a cyber attack.
DDoS
Public admin and defence, social security
Cyber Crime
AR
N/A
75
26/12/2024
25/12/2024
25/12/2024
“h4xx0r1337″
SUBE
The Mi Argentina site and the SUBE card app, two of the government’s most important digital platforms, suffer a cyber attack.
DDoS
Public admin and defence, social security
Cyber Crime
AR
N/A
76
26/12/2024
26/12/2024
26/12/2024
?
Japan Airlines
Japan’s flag carrier announces that it has restored its systems following a cyber incident that delayed some domestic and international flights.
Unknown
Transportation and storage
Cyber Crime
JP
Unknown
77
26/12/2024
24/12/2024
25/12/2024
?
CyberHaven
Data-loss prevention startup Cyberhaven says threat actors published a malicious update to its Chrome extension that was capable of stealing customer passwords and session tokens.
Malware
Professional, scientific and technical
Cyber Crime
US
Compromised Credentials
78
26/12/2024
26/12/2024
26/12/2024
?
X account of Animoca Brands co-founder Yat Siu
A threat actor compromises the X account of Animoca Brands co-founder Yat Siu, using it to promote a fraudulent token.
Account Takeover
Fintech
Cyber Crime
>1
Phishing Email
79
27/12/2024
Since at least 24/12/2024
24/12/2024
?
Crypto Users
Researchers at SlowMist discover a sophisticated phishing campaign masquerading as Zoom meeting invitations resulting in the theft of millions in cryptocurrency.
Account Takeover
Fintech
Cyber Crime
>1
Phishing Email
80
27/12/2024
24/12/2024
24/12/2024
?
Multiple Organizations
A new attack campaign targets known Chrome browser extensions, leading to at least 35 extensions being compromised and exposing over 2.6 million users to data exposure and credential theft.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
81
27/12/2024
-
During November 2024
Salt Typhoon (a.k.a. Earth Estries, FamousSparrow, Ghost Emperor, and UNC2286)
Undisclosed U.S. telecommunications company
A White House official adds a ninth U.S. telecommunications company to the list of telecoms breached in a Chinese hacking campaign that impacted dozens of countries.
Targeted Attack
Information and communication
Cyber Crime
US
Security Appliance Vulnerability
82
27/12/2024
-
-
?
Undisclosed Organizations
Palo Alto Networks warns that threat actors are exploiting the CVE-2024-3393 denial of service vulnerability to disable firewall protections by forcing it to reboot.
DDoS
Unknown
Unknown
Unknown
Security Appliance Vulnerability
83
27/12/2024
?
Multiple Organizations
Researchers at VulnCheck reveal that threat actors are exploiting a post-authentication remote command injection vulnerability in Four-Faith routers tracked as CVE-2024-12856 to open reverse shells back to the attackers.
Unknown
Multiple Industries
Unknown
Unknown
Misconfiguration
84
27/12/2024
25/11/2024
25/11/2024
?
Rutherford County Schools
Rutherford County Schools confirm to be dealing with a “network and systems disruption” since November 25.
Unknown
Education
Cyber Crime
US
Unknown
85
27/12/2024
27/12/2024
27/12/2024
?
Infocert
Infocert, one of the leading Spid digital identity providers in Italy, confirms a serious breach of its users’ personal data. The attackers claim to have stolen a huge volume of data from Infocert’s databases, including 5.5 million registrations, 1.1 million telephone numbers, and 2.5 million email addresses.
Unknown
Professional, scientific and technical
Cyber Crime
IT
Supply Chain Compromise
86
28/12/2024
28/12/2024
28/12/2024
Noname057(16)
Multiple Italian sites, including Malpensa and Linate airports
Pro-Russia group Noname057(16) targets Italian sites, including Malpensa and Linate airports, in a new DDoS campaign amid rising geopolitical tensions.
DDoS
Transportation and storage
Hacktivism
IT
N/A
87
28/12/2024
25/12/2024
-
0mid16B
DEphoto
The threat actor known as 0mid16B breaches DEphoto, a U.K. photo business, twice in few days, acquiring the personal information of 555,952 customers.
SQLi
Arts entertainment, recreation
Cyber Crime
GB
Unknown
88
29/12/2024
-
28/12/2024
Space Bears
Atos
French tech giant Atos, which secures communications for the country's military and secret services, denies claims made by the Space Bears ransomware gang that they compromised one of its databases. Instead the threat actors breached unconnected "external third-party infrastructure," which, although stored data mentioning the company's name, was not managed or secured by Atos.
Ransomware
Professional, scientific and technical
Cyber Crime
FR
Supply Chain Compromise
89
30/12/2024
-
-
?
Android Users in Russia
Researchers at Cyfirma discover FireScam, a new Android malware acting as an information stealer and spyware with broad monitoring capabilities that allow it to harvest and exfiltrate sensitive information from numerous applications, and is distributed disguised as the ‘Telegram Premium’ application, through a phishing website that mimics the legitimate RuStore application store.
Malware
Individual
Cyber Crime
RU
Rogue App
90
30/12/2024
-
08/12/2024
Threat Actors from China
Office of Foreign Assets Control
Chinese state-backed threat actors breach the Office of Foreign Assets Control (OFAC), a Treasury Department office that administers and enforces trade and economic sanctions programs, exploiting a vulnerability in a BeyondTrust Remote Support SaaS instance.
Targeted Attack
Public admin and defence, social security
Cyber Espionage
US
Supply Chain Compromise
91
30/12/2024
-
-
“EC2 Grouper”
Multiple Organizations
Researchers at Fortinet discover a new attacker group known as “EC2 Grouper” who frequently exploits compromised credentials using AWS tools.
Account Takeover
Multiple Industries
Cyber Crime
>1
Compromised Credentials
92
31/12/2024
30/12/2024
30/12/2024
?
Ford X Account
Ford confirms that its X account was briefly compromised, after posts referencing the Israel-Palestine war are published.
Account Takeover
Manufacturing
Cyber Crime
US
Unknown
93
31/12/2024
-
-
?
Thomas Cook
Global travel agency Thomas Cook's Indian arm closes its affected systems after a cyber attack takes down its IT infrastructure.
Unknown
Arts entertainment, recreation
Cyber Crime
IN
Unknown
94
31/12/2024
-
-
RansomHub
Fondo Genesis (MetLife)
The ransomware group RansomHub claims responsibility for a breach of MetLife's operations in Latin America. MetLife denies the allegations, acknowledging a separate cyber incident involving Fondo Genesis, a subsidiary operating solely in Ecuador.
October 2026 Cyber Attacks Timeline
Mega Breaches in 2026
September 2026 Cyber Attacks Timeline
2018: A Year of Cyber Attacks
August 2026 Cyber Attacks Statistics Infographic