In the first timeline of January 2025, I collected 109 events (7.27 events/day) with a threat landscape dominated by malware with 18%, down from 33% of the previous timeline, and once again ahead of account takeovers with 17% (it was 20% in the previous timeline), and ransomware with 14%.
In terms of initial access, phishing emails were still the preferred weapon with 12%, down from 20%, ahead of vulnerabilities exploiting public-facing apps (8%) and security appliances (6%).
Cyber crime led the motivations chart with 71%, down from 76% of the previous timeline, as usual ahead of cyber espionage (11% slightly down from 12%), and hacktivism with 4%, slightly down from 5%. Cyber warfare closes the chart with 4 events corresponding to 4%.
Multiple organizations led the sectors chart with 21%, down from 21%, ahead of governments with 17%, up from 10% and individuals, back in the top three with 14%.
Besides these trends, as always the timeline is rich of interesting events, such as mega breaches and attacks against organizations in the fintech space, so my final suggestion does not change: browse the timeline for the details of the events collected in this fortnight.
Feel free to share it to support my work and spread the risk awareness across the community. And last but not least, don’t forget to connect on Linkedin, or even follow @paulsparrows on X (formerly Twitter), psparrows.bsky.social on Bluesky, or @ppasseri@Infosec.exchange on Mastodon for the latest updates.
Geo Map January H1 2025
No Data Found
No Data Found
BE NOTIFIED OF NEW POSTS
SUPPORT MY WORK! MAKE A DONATION
Creating the timelines is a very time-consuming task.
In this first quarter of 2024, threat actors have been particularly busy in exploiting vulnerabilities (0-days but also old unpatched flaws) targeting traditional remote access technologies.
A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
A live, continuously updated timeline of the cyber attacks reported in September 2026 — tracking threat actors, attack techniques, targeted sectors and countries as each incident is vetted and added.
September 2026 recorded 182 cyber incidents, and Cyber Crime drove roughly three in four of them (73.9%). Malware was the top attack vector at 27.8%, exploitation of public-facing applications led initial access at 28.9%, and Information & Communication was the most targeted sector. Explore the ...
AI agents are escaping sandboxes, misusing credentials and acting without authorization. This live dashboard tracks every reported incident on a horizontal timeline, with charts showing which AI companies and agents are involved, the techniques used and how they got in. It updates automatically as new ...
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information
Researchers at Socket discover several malicious packages on the npm registry impersonating the Nomic Foundation's Hardhat tool in order to steal sensitive data from developer systems.
Malware
Fintech
Cyber Crime
>1
Supply Chain Compromise
2
02/01/2025
02/01/2025
02/01/2025
?
NTT Docomo
Japan’s largest mobile carrier, NTT Docomo, reports that it is working to restore services after a cyberattack temporarily disrupted operations.
DDoS
Information and communication
Cyber Crime
JP
N/A
3
02/01/2025
-
-
?
Multiple Organizations
Researchers at Cyfirma share the details of a new remote access trojan called NonEuclid that allows bad actors to remotely control compromised Windows systems.
Malware
Multiple Industries
Cyber Crime
>1
Unknown
4
03/01/2025
-
-
?
Chrome Users
EditThisCookie, a browser extension with over 3 million downloads is removed from the Chrome Web Store and in its place, a new extension emerges, which not only mimics the original’s name and design but also contains malicious code designed to steal user cookies and even post phishing content through their social media accounts.
Malicious Browser Extension
Individual
Cyber Crime
>1
App Store
5
03/01/2025
-
-
?
Individuals
Researchers at Malwarebytes discover a new, malicious campaign asking the victims about their interest in beta testing a new videogame, but distributing a download link and a password for the archive containing malware.
Malware
Individual
Cyber Crime
>1
Instant Messaging
SMS
Phishing Email
6
03/01/2025
During 2024
During 2024
?
Multple Organizations
Researchers at Socket reveal to have observed and identified malicious JavaScript, Python, and Ruby packages leveraging OAST services such as oastify.com and oast.fun to exfiltrate sensitive data to attacker-controlled servers.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
7
03/01/2025
From early to mid-November 2024
From early to mid-November 2024
?
Individuals
Researchers at Cofense discover a campaign via multople phishing emails impersonating the US Social Security Administration to deploy the ConnectWise Remote Access Trojan.
Malware
Individual
Cyber Crime
US
Phishing Email
8
03/01/2025
24/10/2024
01/10/2024
?
Bank of America
Bank of America notifies 414 individuals that their names, addresses, phone numbers, passport numbers, Social Security numbers, and their mortgage load numbers might have been compromised in a data breach at an unnamed third-party provider.
Unknown
Finance and insurance
Cyber Crime
US
Supply Chain Compromise
9
03/01/2025
During 2024
During 2024
Russian state-affiliated entity
2024 US Presidential Election
The US sanctions Moscow-based Center for Geopolitical Expertise (CGE) for a sophisticated GenAI-based disinformation operation which targeted the 2024 US Presidential election.
Coordinated Inauthentic Behavior
Individual
Cyber Warfare
US
N/A
10
03/01/2025
During 2024
During 2024
Russian state-affiliated entity
2024 US Presidential Election
The US also sanctions the Cognitive Design Production Center (CDPC), a subsidiary organization of Iran’s Islamic Revolutionary Guard Corps (IRGC), for influence operations designed to incite socio-political tensions among the US electorate in the lead up to the 2024 US elections.
Coordinated Inauthentic Behavior
Individual
Cyber Warfare
US
N/A
11
03/01/2025
30/12/2024
30/12/2024
?
Resona Bank
Osaka-based Resona Bank says a DDoS attack resulted in a network malfunction and impacted the functioning of its customer-facing My Gate application. The parent company Resona Holdings confirms the incident temporarily disrupted services at other company-owned banks, including Minato Bank, Kansai Mirai Bank and Saitama Resona Bank.
DDoS
Finance and insurance
Cyber Crime
JP
N/A
12
03/01/2025
31/12/2024
31/12/2024
?
Mizuho Bank
Mizuho Bank, Japan's third largest financial company, suffers a denial-of-service attack that disrupts online banking services for three hours.
DDoS
Finance and insurance
Cyber Crime
JP
N/A
13
04/01/2025
-
-
Salt Typhoon, a.k.a. Earth Estries, FamousSparrow, GhostEmperor, and UNC2286
Charter Communications
Charter Communications joins the list of the U.S. telecommunications firms hacked in a wave of breaches by a Chinese state-backed threat group tracked as Salt Typhoon.
Targeted Attack
Information and communication
Cyber Espionage
US
Hardware Vulnerability
14
04/01/2025
-
-
Salt Typhoon, a.k.a. Earth Estries, FamousSparrow, GhostEmperor, and UNC2286
Consolidated Communications
Consolidated Communications joins the list of the U.S. telecommunications firms hacked in a wave of breaches by a Chinese state-backed threat group tracked as Salt Typhoon.
Targeted Attack
Information and communication
Cyber Espionage
US
Hardware Vulnerability
15
04/01/2025
-
-
Salt Typhoon, a.k.a. Earth Estries, FamousSparrow, GhostEmperor, and UNC2286
Windstream
Windstream joins the list of the U.S. telecommunications firms hacked in a wave of breaches by a Chinese state-backed threat group tracked as Salt Typhoon.
Targeted Attack
Information and communication
Cyber Espionage
US
Hardware Vulnerability
16
05/01/2025
-
-
?
Argentina’s airport security police (PSA)
Argentina’s airport security police (PSA) falls victim to a cyberattack that reportedly compromised the personal and financial data of its officers and civilian personnel.
Unknown
Transportation and storage
Cyber Crime
AR
Software Vulnerability
17
06/01/2025
-
-
?
Individuals
Researchers at SlashNext discover a new WordPress plugin called PhishWP, used by cybercriminals to create fake payment pages mimicking legitimate services like Stripe, enabling the theft of sensitive financial and personal data.
Account Takeover
Finance and insurance
Cyber Crime
>1
Rogue Website
18
06/01/2025
-
-
?
ISPs and governmental entities in the Middle East
Researchers at Kaspersky discover new variants of the Eagerbee malware framework deployed against government organizations and internet service providers (ISPs) in the Middle East.
Targeted Attack
Multiple Industries
Cyber Espionage
>1
Unknown
19
06/01/2025
23/09/2024
23/10/2024
?
Green Bay Packers
The Green Bay Packers American football team notifies fans that a threat actor hacked its official online retail store in October and injected a card skimmer script to steal customers' personal and payment information.
Malicious Script Injection
Arts entertainment, recreation
Cyber Crime
US
Public-facing App Vulnerability
20
06/01/2025
-
-
natohub
United Nations' International Civil Aviation Organization (ICAO)
The United Nations' International Civil Aviation Organization (ICAO) announces it is investigating what it describes as a "reported security incident." 42,000 recruitment application data records are affected.
Unknown
Extraterritorial orgs and bodies
Cyber Crime
UN
Unknown
21
06/01/2025
05/01/2025
05/01/2025
?
South Portland Public Schools
South Portland Public Schools in Maine says it was forced to take its network after a cyberattack was discovered over the weekend.
Unknown
Education
Cyber Crime
US
Unknown
22
06/01/2025
Between 04/12/2024 and 04/01/2025
Between 04/12/2024 and 04/01/2025
Pro-Russian Threat Actors
Public Opinion in Croatia
The independent Croatian Centre for Information Resilience reveals that “Pro-Russian, anti-EU, and anti-NATO bot networks” are attempting to sway opinion ahead of the Croatian presidential runoff.
Coordinated Inauthentic Behavior
Individual
Cyber Warfare
HR
N/A
23
07/01/2025
-
-
?
U.S. Federal Agencies
CISA warns U.S. federal agencies to secure their systems against CVE-2020-2883, a critical vulnerability in Oracle WebLogic Server actively exploited in attacks.
Unknown
Public admin and defence, social security
Unknown
US
Public-facing App Vulnerability
24
07/01/2025
-
-
?
U.S. Federal Agencies
CISA warns U.S. federal agencies to secure their systems against CVE-2024-41713, a critical vulnerability in Mitel MiCollab actively exploited in attacks.
Unknown
Public admin and defence, social security
Unknown
US
Public-facing App Vulnerability
25
07/01/2025
-
-
?
U.S. Federal Agencies
CISA warns U.S. federal agencies to secure their systems against a second Mitel vulnerability CVE-2024-55550 actively exploited in attacks.
Unknown
Public admin and defence, social security
Unknown
US
Public-facing App Vulnerability
26
07/01/2025
As early as 09/11/2024
09/11/2024
?
Multiple organizations
Researchers at XLab unveil Gayfemboy, a Mirai-based botnet growing in sophistication and everaging zero-day exploits for security flaws in industrial routers and smart home devices.
Malware
Multiple Industries
Cyber Crime
CN
IR
RU
TR
US
IoT Vulnerability
27
07/01/2025
07/01/2025
07/01/2025
Ukrainian Cyber Alliance
Nodex
Ukrainian hacktivists, part of the Ukrainian Cyber Alliance group, announce they had breached Russian internet service provider Nodex's network and wiped hacked systems after stealing sensitive documents.
Unknown
Information and communication
Hacktivism
RU
N/A
28
07/01/2025
Since at least 16/12/2024
07/01/2025
?
Undisclosed Organization(s)
Researchers at Greynose reveal that threat actors are trying to exploit CVE-2024-52875, a critical CRLF injection vulnerability that leads to 1-click remote code execution (RCE) attacks in GFI KerioControl firewall product.
Unknown
Unknown
Unknown
Unknown
Security Appliance Vulnerability
29
07/01/2025
-
28/12/2024
?
PowerSchool
Education software firm PowerSchool confirms it suffered a cybersecurity incident that allowed a threat actor to steal the personal information of students and teachers from school districts using its PowerSchool SIS platform.
Account Takeover
Professional, scientific and technical
Cyber Crime
US
Compromised Credentials
30
07/01/2025
29/12/2023
29/12/2023
?
Medusind
Medusind, a leading billing provider for healthcare organizations, notifies hundreds of thousands of individuals of a data breach that exposed their personal and health information more than a year ago, in December 2023. 360,934 individuals are affected.
Unknown
Professional, scientific and technical
Cyber Crime
US
Unknown
31
07/01/2025
10/10/2024
20/11/2024
Everest
STIIIZY
Popular cannabis brand STIIIZY discloses a data breach after threat actors breached its point-of-sale (POS) vendor to steal customer information, including government IDs and purchase information. The Everest. ransomware group claims responsibility for the attack.
Ransomware
Wholesale and retail
Cyber Crime
US
Supply Chain Compromise
32
07/01/2025
-
-
?
Multiple Organizations
Researchers at Sans reveal that threat actors are leveraging susceptible and misconfigured PHP servers (e.g., CVE-2024-4577) to deploy a cryptocurrency miner called PacketCrypt.
Malware
Multiple Industries
Cyber Crime
>1
Misconfiguration
Public-facing App Vulnerability
33
07/01/2025
18/06/2024
23/06/2024
Monti
Excelsior Orthopaedics
Excelsior Orthopaedics notifies approximately 357,000 people that their personal and health information was compromised in a data breach resulting from a ransomware attack that came to light in June 2024.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
34
07/01/2025
07/01/2025
07/01/2025
?
Addison Northwest School District
The Addison Northwest School District (ANWSD) suffers a ransomware attack.
Ransomware
Education
Cyber Crime
US
Unknown
35
08/01/2025
Early December 2024
Early December 2024
?
Multiple organizations
Researchers at Fortinet discover a new phishing technique exploiting PayPal’s money request feature, using a legitimate PayPal money request that may appear genuine to recipients.
Account Takeover
Multiple Industries
Cyber Crime
>1
Phishing Email
36
08/01/2025
-
-
?
Individuasl in the Middle East
Researchers at Group-IB reveal that fraudsters have devised a sophisticated scheme targeting banking customers in the Middle East, impersonating government officials and using remote access software to steal credit card information and OTP codes.
Account Takeover
Finance and insurance
Cyber Crime
>1
Social Engineering
37
08/01/2025
Since at least December 2022
-
Threat actors from China
Residents of greater China
Researchers at Infoblox discover a campaign distributing email messages with attachments containing QR codes that lead to phishing sites. It also instructs recipients to open the attachment and use the AliPay or WeChat apps on their phones to scan the QR code.
Account Takeover
Individual
Cyber Crime
CN
Phishing Email
38
08/01/2025
-
-
Threat actors from China
Individuals in Japan
Reserchers from Infoblox discover a malspam operation targeting Japanese users, involving emails referencing popular brands like Electronic Toll Collection (ETC), Sumitomo Mitsui Banking Corporation (SMBC), Amazon, and Mastercard. The emails urged users to authenticate due to security concerns, leading them to a traffic distribution system (TDS) and eventually to fake login pages that steal credentials.
Account Takeover
Individual
Cyber Crime
JP
Malspam
39
08/01/2025
-
-
Threat actors from China
Crypto Users in Japan
Researchers from Infoblox discover a campaign targeting Japanese users with spam messages related to MyEtherWallet, a popular crypto wallet. These messages used lookalike domains and sometimes included Japanese text, asking users to log in to their accounts. Although the links appeared legitimate, they led to fake domains created by the threat actors.
Account Takeover
Fintech
Cyber Crime
JP
Malspam
40
08/01/2025
-
-
Threat actors from China
Individuals
Researchers at Infoblox discover a campaign involving extortion emails claiming that a hacker had accessed the user’s device and recorded embarrassing activities, featuring domain spoofing.
Scam
Individual
Cyber Crime
Unknown
Malspam
41
08/01/2025
'Every two out of three days in 2024'
-
Threat actors from China
Individuals
Researchers at Infoblox discover a mysterious and active spam campaign using spoofed sender domains and benign Excel spreadsheet attachments with no evident purpose.
Unknown
Individual
Cyber Crime
Unknown
Malspam
42
08/01/2025
From December 2019 to July 2023
From February to October 2023
From June 2024
-
MirrorFace a.k.a. Earth Kasha (sub-group within APT10)
Organizations, businesses, and individuals in Japan (think tanks, governments, politicians, media organizations, semiconductor, manufacturing, communications, academic, and aerospace sectors)
Japan's National Police Agency (NPA) and National Center of Incident Readiness and Strategy for Cybersecurity (NCSC) accuse a China-linked threat actor named MirrorFace of orchestrating a persistent attack campaign targeting organizations, businesses, and individuals in the country since 2019.
Targeted Attack
Multiple Industries
Cyber Espionage
JP
Phishing Email
Security Appliance Vulnerabilities
43
08/01/2025
-
-
?
Organizations in the Crypto Space
Researchers at Socket identify three sets of malicious packages across the npm and Python Package Index (PyPI) repository that come with capabilities to steal data and even delete sensitive data from infected systems.
Malware
Fintech
Cyber Crime
>1
Supply Chain Compromise
44
08/01/2025
Since at least 07/01/2025
07/01/2025
?
Individuals
Researchers at CrowdStrike alert of a phishing campaign that exploits its own branding to distribute the XMRig cryptocurrency miner that's disguised as an employee CRM application as part of a supposed recruitment process.
Malware
Individual
Cyber Crime
>1
Phishing Email
45
08/01/2025
-
-
?
Individuals in South Korea
Researchers at AhnLab Security Intelligence Center (ASEC) unveil a sophisticated distribution tactic for the LummaC2 malware, employing a fake CAPTCHA verification page to trick unsuspecting victims into executing harmful scripts.
Malware
Individual
Cyber Crime
KR
Phishing Email
Rogue App
46
08/01/2025
-
-
Unknown Threat Actors
Unknown Organization(s)
Ivanti warns that threat actors exploited a Connect Secure remote code execution vulnerability tracked as CVE-2025-0282 in zero-day attacks to install malware on appliances.
Malware
Unknown
Unknown
Unknown
Security Appliance Vulnerability
47
08/01/2025
Mid-December 2024
Since at least mid-December 2024
UNC5221
Multiple Organizations
Researchers at Mandiant reveal that CVE-2025-0282, a newly publicized vulnerability in popular products from tech company Ivanti is being exploited by China-based espionage threat actors.
Targeted Attack
Multiple Industries
Cyber Espionage
>1
Security Appliance Vulnerability
48
08/01/2025
08/01/2025
08/01/2025
?
Gateshead Council
Gateshead Council suffers a cyber attack.
Unknown
Public admin and defence, social security
Cyber Crime
GB
Unknown
49
08/01/2025
08/01/2025
08/01/2025
?
Orange Finances
Orange Finances announces that a threat actor compromised the admin address, upgraded contracts, and transferred funds to their wallet for an estimated loss of more than $840K.
Account Takeover
Fintech
Cyber Crime
N/A
Leaked Private Key
50
09/01/2025
-
-
?
Multiple Organizations
Researchers at Sucuri discover a sophisticated credit card skimmer malware targeting WordPress websites, silently injecting malicious JavaScript into database entries to steal sensitive payment details.
Malicious Script Injection
Wholesale and retail
Cyber Crime
>1
Unknown
51
09/01/2025
Since September 2024
During September 2024
?
Multiple Organizations
Researchers at Check Point discover a new version of the Banshee macOS Stealer, a malware that steals browser credentials, cryptocurrency wallets, and other sensitive data.
Malware
Multiple Industries
Cyber Crime
>1
Phishing Email
Rogue GitHub Repository
52
09/01/2025
Since at least December 2024
Since at least December 2024
?
Security Researchers
Researchers at Trend Micro discover a deceptive proof-of-concept (PoC) exploit for CVE-2024-49113 (aka "LDAPNightmare") on GitHub, which infects users with infostealer malware that exfiltrates sensitive data to an external FTP server.
Malware
Multiple Industries
Cyber Crime
>1
Rogue GitHub Repository
53
09/01/2025
-
-
Silent Crow
Rosreestr
Silent Crow, a group of threat actors with unknown ties claims responsibility for breaching a Russian government agency, Rosreestr, which is responsible for managing property and land records.
Unknown
Public admin and defence, social security
Hacktivism
RU
N/A
54
09/01/2025
During July 2024
During September 2024
Hunters International
Undisclosed Organization
Researchers at Forescout detail a Hunters International attack that likely leveraged Oracle WebLogic Server as an initial entry point to drop a China Chopper web shell.
Ransomware
Unknown
Cyber Crime
Unknown
Public-facing App Vulnerability
55
09/01/2025
Between July 2023 and December 2024.
Between July 2023 and December 2024.
RedDelta (a.k.a. BASIN, Bronze President, Camaro Dragon, Earth Preta, HoneyMyte, Mustang Panda, Red Lich, Stately Taurus, TA416, and Twill Typhoon.
Multiple Organizations in Mongolia, Taiwan, Myanmar, Vietnam, and Cambodia
Researchers at Recorded Future observe the Chinese state-sponsored group RedDelta targeting Mongolia, Taiwan, Myanmar, Vietnam, and Cambodia with an adapted infection chain to distribute its customized PlugX backdoor.
Targeted Attack
Public admin and defence, social security
Cyber Espionage
KH
MM
MN
TW
VN
Phishing Email
56
09/01/2025
'Recently'
'Recently'
“k303903”
GroupGreeting[.]com
Researchers at Malwarebytes discover “zqxq”, a widespread cyberattack that compromised GroupGreeting[.]com, a popular platform used by major enterprises to send digital greeting cards.
Malicious Script Injection
Arts entertainment, recreation
Cyber Crime
US
Unknown
57
09/01/2025
End of December 2024
08/01/2025
?
Nominet
Nominet, the official .UK domain registry and one of the largest country code registries, confirms that its network was breached two weeks ago using CVE-2025-0282, an Ivanti VPN zero-day vulnerability.
Unknown
Information and communication
Cyber Crime
GB
Security Appliance Vulnerability
58
09/01/2025
23/09/2024
11/10/2024
RansomHub
BayMark Health Services
BayMark Health Services, North America's largest provider of substance use disorder (SUD) treatment and recovery services, notifies an undisclosed number of patients that attackers stole their personal and health information in a September 2024 breach. The RansomHub operation claimed responsibility for the breach.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
59
09/01/2025
26/12/2024
26/12/2024
?
City of Winston-Salem
Winston-Salem, North Carolina, residents are not able to pay their utility bills online after a post-Christmas cyberattack knocked the city’s systems offline.
Unknown
Public admin and defence, social security
Cyber Crime
US
Unknown
60
09/01/2025
09/01/2025
09/01/2025
?
Moby Trade
Moby Trade is the victim of a $2.5 million hack exploiting a compromised private key. However, a mistake by the attacker allows a whitehat to steal $1.5 million back and return it to the protocol.
Account Takeover
Fintech
Cyber Crime
N/A
Leaked Private Key
61
09/01/2025
-
04/11/2024
?
Alaska Division of Retirement and Benefits
The Alaska Division of Retirement and Benefits is hacked and State residents who work in the public sector, have employer contributions to their retirement accounts impacted
Unknown
Public admin and defence, social security
Cyber Crime
US
Unknown
62
10/01/2025
Since late 2024
-
FunkSec
Multiple Organizations
Researchers at Check Point shed light on a nascent artificial intelligence (AI) assisted ransomware family called FunkSec that sprang forth in late 2024, and has claimed more than 85 victims to date.
Ransomware
Multiple Industries
Cyber Crime
BR
ES
IL
IN
IT
MN
US
Unknown
63
10/01/2025
Since at least 2017
-
?
Unknown Orrganization(s)
A severe security vulnerability is discovered in several Netgear routers, allowing remote attackers to gain unauthorized access and control over the devices. The vulnerability, identified as CVE-2024-12847 (CVSS 9.8), has been exploited in the wild since at least 2017.
Unknown
Unknown
Unknown
Unknown
Hardware Vulnerability
64
10/01/2025
'Recently'
'Recently'
?
Crypto Investors
Researchers at ScamSniffer reveal that threat actors are employing a new tactic called "transaction simulation spoofing" to steal crypto, with one attack successfully stealing 143.45 Ethereum, worth approximately $460,000.
Account Takeover
Fintech
Cyber Crime
>1
Software Vulnerability
65
10/01/2025
Early January 2025
Early January 2025
?
Multiple Organizations
Researchers at Cyderes uncover a phishing trend exploiting YouTube URLs combined with Microsoft 365 password expiry lures to deceive users into divulging sensitive credentials.
Account Takeover
Multiple Industries
Cyber Crime
>1
Phishing Email
66
10/01/2025
Since at least early December2024
Early December2024
?
Multiple Organizations
Researchers at Arctic Wolf observe a recent campaign affecting Fortinet FortiGate firewall devices with management interfaces exposed on the public internet, exploiting CVE-2024-55591. Few days later the security product maker confirms that the critical vulnerability is “being exploited in the wild.”
Unknown
Multiple Industries
Unknown
Unknown
Security Appliance Vulnerability
67
10/01/2025
-
-
?
Indviduals
Researchers at Trend Micro uncover a campaign on YouTube, on which threat actors are posing as "guides" offering legitimate software installation tutorials to lure viewers into reading the video descriptions or comments, where they then include links to fake software downloads that lead to malware.
Malware
Individual
Cyber Crime
>1
Rogue App
68
10/01/2025
Since November 2023
Mid to late 2024
RedCurl (a.k.a. Earth Kapre and Red Wolf)
Multiple Organizations in Canada
Researchers at Huntress uncover activity across several organizations in Canada, with similar infrastructure and TTPs used that can be associated with the APT group known as RedCurl.
Targeted Attack
Multiple Industries
Cyber Espionage
CA
Unknown
69
10/01/2025
13/12/2023
18/04/2024
?
Wolf Haldenstein Adler Freeman & Herz
Wolf Haldenstein Adler Freeman & Herz LLP ("Wolf Haldenstein") a U.S. Law Firm, reports it has suffered a data breach that exposed the personal information of nearly 3.5 million individuals to threat actors.
Unknown
Professional, scientific and technical
Cyber Crime
US
Unknown
70
10/01/2025
-
-
Silk Typhoon
Committee on Foreign Investment in the United States (CFIUS)
Silk Typhoon Chinese state-backed threat actors reportedly breach the Committee on Foreign Investment in the United States (CFIUS), a Treasury Department office that reviews foreign investments for national security risks.
Targeted Attack
Public admin and defence, social security
Cyber Espionage
US
Unknown
71
10/01/2025
09/01/2025
09/01/2025
DNA, Grep, Pryx, and Rey (Hellcat ransomware group)
Telefónica
Spanish telecommunications company Telefónica confirms an internal ticketing system was breached after stolen data is leaked on a hacking forum.
Ransomware
Information and communication
Cyber Crime
ES
Compromised Credentials
72
10/01/2025
07/01/2025
07/01/2025
?
Slovakian Geodesy, Cartography and Cadastre Office (UGKK)
A cyber attack targets the Slovakian Geodesy, Cartography and Cadastre Office (UGKK), which manages land and property data. The agency’s systems are shut down, and its physical offices closed following an alleged ransomware attack. According to local media reports, the attackers are demanding millions of euros in ransom.
Ransomware
Public admin and defence, social security
Cyber Crime
SK
Unknown
73
10/01/2025
-
-
Threat Actors from Russia
Public Opinion in Poland
According to a state official, a Russia-linked disinformation campaign has made attempts to influence Poland’s upcoming presidential elections in May.
Coordinated Inauthentic Behavior
Individual
Cyber Warfare
PL
N/A
74
10/01/2025
20/12/2024
20/12/2024
?
Government of Turks and Caicos
The government of Turks and Caicos says is making progress in its recovery from a recent ransomware attack that has caused widespread issues on the islands.
Ransomware
Public admin and defence, social security
Cyber Crime
TC
Unknown
75
10/01/2025
-
04/01/2025
?
Gravy Analytics
Gravy Analytics, a major player in the location data broker market confirms to Norway’s Data Protection Authority that it was breached by a threat actor who obtained an unknown number of files.
Unknown
Professional, scientific and technical
Cyber Crime
NO
Unknown
76
11/01/2025
07/01/2025
07/01/2025
?
Multiple Organizations
Researchers at Wiz reveal that threat actors are exploiting a critical remote command execution vulnerability, tracked as CVE-2024-50603, in Aviatrix Controller instances to install backdoors and crypto miners.
Malware
Multiple Industries
Cyber Crime
>1
Public-facing App Vulnerability
77
11/01/2025
26/12/2024
26/12/2024
Qilin
City of West Haven
The government of West Haven, Connecticut, says it is investigating a cyberattack that recently forced it to temporarily shut down all of its IT systems. The Qilin ransomware group claims responsibilty for the attack.
Ransomware
Public admin and defence, social security
Cyber Crime
US
Unknown
78
11/01/2025
11/01/2025
11/01/2025
NoName057(16)
Italian ministries and government institutions
Pro-Russia threat actors from Noname057(16) target Italian ministries, institutions, critical infrastructure’s websites and private organizations in coincidence with the visit of Ukrainian President Volodymyr Zelensky to Italy.
DDoS
Public admin and defence, social security
Hacktivism
IT
N/A
79
12/01/2025
Since November 2024
Since November 2024
?
Individuals
In a recent campaign threat actors are exploiting a trick to turn off Apple iMessage's built-in phishing protection for a text and trick users into re-enabling disabled phishing links.
Account Takeover
Individual
Cyber Crime
>1
SMS
80
12/01/2025
11/01/2025
11/01/2025
?
Eindhoven University of Technology
Eindhoven University of Technology cancels “lectures and other educational activities” following a cyberattack, although it is expected to have only a limited impact as teaching is reduced while students prepare for exams.
Unknown
Education
Cyber Crime
NL
Unknown
81
12/01/2025
12/01/2025
12/01/2025
NoName057(16)
Italian banks and private businesses
Pro-Russia threat actors from Noname057(16) target again Italian ministries, institutions, critical infrastructure’s websites and private organizations in coincidence with the visit of Ukrainian President Volodymyr Zelensky to Italy.
DDoS
Multiple Industries
Hacktivism
IT
N/A
82
12/01/2025
16/01/2024
25/03/2024
DragonForce
Teton Orthopaedics
Teton Orthopaedics discloses a DragonForce ransomware attack. A total of 13,409 people are affected by the incident.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
83
13/01/2025
09/01/2025
09/01/2025
Yellow Drift
Phishing Email
Rogue App
Roseltorg, Russia’s main electronic trading platform for government and corporate procurement confirms that it had been targeted by a cyberattack. Pro-Ukraine hacker group Yellow Drift claims responsibility.
Unknown
Public admin and defence, social security
Hacktivism
RU
N/A
84
13/01/2025
-
-
Cyber Anarchy Squad
Infobis
Ukrainian threat group Cyber Anarchy Squad takes responsibility for an attack against Russian agricultural tech firm Infobis, which purportedly leads to the theft of 3 TB of data in addition to infrastructure damage.
Unknown
Professional, scientific and technical
Hacktivism
RU
N/A
85
13/01/2025
Since 06/01/2025
13/01/2025
?
Multiple Organizations
Threat actors are utilizing the FastHTTP Go library to launch high-speed brute-force password attacks targeting Microsoft 365 accounts globally.
Account Takeover
Multiple Industries
Cyber Crime
>1
Brute-force
86
13/01/2025
-
-
?
Multiple Organizations
Researchers at c/side uncover a new malware campaign compromising more than 5,000 WordPress sites through the WP3[.]XYZ malware, to create admin accounts, install a malicious plugin, and steal data.
Malware
Multiple Industries
Cyber Crime
MY
Phishing Email
87
13/01/2025
-
-
Codefinger
Multiple Organizations
Researchers at Halcyon identify a new ransomware campaign targeting Amazon S3 buckets, and leveraging AWS’s Server-Side Encryption with Customer Provided Keys (SSE-C) to encrypt data, demanding ransom payments for the symmetric AES-256 keys required to decrypt it.
Ransomware
Multiple Industries
Cyber Crime
>1
Compromised Credentials
88
13/01/2025
-
-
?
Undisclosed Organization
Researchers at SlashNex witness a surge in "rapid-fire" phishing campaigns mimicking the Black Basta ransomware crew's email bombing technique to flood victims' inboxes with legitimate messages related to newsletters or payment notices, and using social engineering tactics to lure the victims to install remote access tools.
Malware
Multiple Industries
Cyber Crime
>1
Social Engineering
89
13/01/2025
-
-
?
U.S. Federal Agencies
CISA reveals that the command injection vulnerability (CVE-2024-12686) in BeyondTrust's Privileged Remote Access (PRA) and Remote Support (RS) is actively exploited in attacks.
Unknown
Public admin and defence, social security
Unknown
US
Public-facing App Vulnerability
90
13/01/2025
-
-
?
U.S. Federal Agencies
CISA adds the CVE-2023-48365 Qlik Sense HTTP Tunneling Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog:
Unknown
Public admin and defence, social security
Unknown
US
Public-facing App Vulnerability
91
13/01/2025
Since at least November 2024
Since at least November 2024
?
Path of Exile 2 Players
Path of Exile 2 developers confirm that a hacked admin account allowed a threat actor to change the password and access at least 66 accounts, finally explaining how PoE 2 accounts have been breached since November.
Account Takeover
Arts entertainment, recreation
Cyber Crime
>1
Compromised Credentials
92
13/01/2025
16/10/2024
Since at least 16/10/2024
UAC-0063, overlapping with APT28, a.k.a. Blue Athena, BlueDelta, Fancy Bear, Fighting Ursa, Forest Blizzard, FROZENLAKE, Iron Twilight, ITG05, Pawn Storm, Sednit, Sofacy, and TA422.
Multiple organizations in Kazakhstan
Researchers at Sekoia attribute the Russia-linked threat actors from APT28 to an ongoing cyber espionage campaign targeting Kazakhstan as part of the Kremlin's efforts to gather economic and political intelligence in Central Asia.
Targeted Attack
Public admin and defence, social security
Cyber Espionage
KZ
Phishing Email
93
13/01/2025
18/07/2024
09/12/2024
?
Avery Products Corporation
Avery Products Corporation warns it suffered a data breach after its website was hacked to steal customers' credit cards and personal information.
Malicious Script Injection
Professional, scientific and technical
Cyber Crime
US
Unknown
94
13/01/2025
Between November and December 2024
Between November and December 2024
?
Multiple Organizations
Researchers at SlashNext witness a surge in "rapid-fire" phishing campaigns mimicking the Black Basta ransomware crew's email bombing technique to flood victims' inboxes with over 1,100 legitimate messages related to newsletters or payment notices.
Account Takeover
Multiple Industries
Cyber Crime
>1
Social Engineering
95
13/01/2025
08/01/2025
08/01/2025
?
City of Corvallis
A Corvallis city councilor’s email is hacked by a scammer and used to reach nearly 3,500 email addresses in an attempt to steal the recipients' personal information.
Account Takeover
Public admin and defence, social security
Cyber Crime
US
Phishing Email
96
14/01/2025
23/12/2024
02/01/2025
?
Multiple Organizations
An attacker accesses Kong’s DockerHub account and replaces the legitimate Kong Ingress Controller v.3.4.0 image with a malicious version containing malicious code that enabled cryptojacking.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
97
14/01/2025
Since at least late November 2024
Late November 2024
?
Multiple Organizations
Researchers at Infoblox reveal that a newly discovered botnet of 13,000 MikroTik devices uses a misconfiguration in domain name server records to bypass email protections and deliver malware by spoofing roughly 20,000 web domains.
Malware
Multiple Industries
Cyber Crime
>1
Malspam
98
14/01/2025
-
-
?
Unknown Organization(s)
Microsoft's January 2025 Patch Tuesday addresses 159 security flaws, including eight zero-day vulnerabilities, three of which, CVE-2025-21333, CVE-2025-21334, CVE-2025-21335, are being actively exploited in attacks.
Unknown
Unknown
Unknown
Unknown
OS Vulnerability
99
14/01/2025
During 2022
"Belsen Group"
Multiple Organizations
A new group dubbed "Belsen Group" leaks the configuration files, IP addresses, and VPN credentials for over 15,000 FortiGate devices on the dark web in a 1.6 GB archive, allegedly obtained exploiting CVE-2022–40684.
Unknown
Multiple Industries
Cyber Crime
>1
Security Appliance Vulnerability
100
14/01/2025
11/12/2024
12/12/2024
Black Basta
Mortgage Investors Group
Mortgage Investors Group (MIG), one of the largest mortgage lenders in the Southeast U.S. says it suffered a cybersecurity incident last month that exposed troves of customer information. The Black Basta ransomware group claims responsibility for the attack.
Ransomware
Finance and insurance
Cyber Crime
US
Unknown
101
14/01/2025
-
-
?
Individuals
Researchers at ANY.RUN reveal that threat actors are exploiting fake YouTube links to redirect users to phishing pages, stealing login credentials via URI manipulation and layered obfuscation techniques.
Account Takeover
Individual
Cyber Crime
>1
Social Media
102
15/01/2025
-
-
?
Multiple Organizations
Researchers at Malwarebytes discover a malicious campaign using Google search advertisements to promote phishing sites that steal advertisers' credentials for the Google Ads platform.
Account Takeover
Multiple Industries
Cyber Crime
>1
Malvertising
103
15/01/2025
During Q4 2024
During Q4 2024
RansomHub
Undisclosed Organization
Researchers at Guidepoint Security detail an attack that involved a threat actor utilizing a Python-based backdoor to maintain persistent access to compromised endpoints and then leveraged this access to deploy the RansomHub ransomware throughout the target network.
Ransomware
Unknown
Cyber Crime
Unknown
Drive-by Download
104
15/01/2025
Since at least 09/01/2025
09/01/2025
Lazarus Group
Multiple organizations in the Crypto Space
Researchers at SecurityScorecard uncovered Operation 99, a campaign by the Lazarus Group, North Korea’s state-sponsored hacking unit, targeting software developers looking for freelance Web3 and cryptocurrency work.
Targeted Attack
Fintech
Cyber Crime
Cyber Espionage
AR
BR
DE
EG
FR
GB
ID
IN
IT
MX
PH
PK
US
Social Engineering
105
15/01/2025
Since November 2024
Since November 2024
?
Multiple organizations in Indonesia
Researchers at Imperva expose a new campaign that targets web servers running PHP-based applications to install GSocket (aka Global Socket) and promote gambling platforms in Indonesia.
Malware
Multiple Industries
Cyber Crime
ID
Website Vulnerability
106
15/01/2025
10/01/2025
10/01/2025
Fog
University of Oklahoma
The University of Oklahoma says it is taking steps to address unusual cyber activity it discovered on its network. The Fog ransomware group claims responsibility for the attack.
Ransomware
Education
Cyber Crime
US
Unknown
107
15/01/2025
Early January 2024
13/01/2025
Sticky Werewolf
Russian scientific and industrial enterprises
Researchers at F.A.A.C.T. reveal that Sticky Werewolf, a suspected Ukraine-linked group is targeting Russian scientific and industrial enterprises in a new cyber-espionage campaign, researchers have found.
Targeted Attack
Professional, scientific and technical
Cyber Espionage
RU
Phishing Email
108
15/01/2025
12/01/2025
15/01/2025
“0mid16B”
MedSave Health Insurance
A threat actor with the Moniker “0mid16B” claims to have breached MedSave Health Insurance TPA Ltd (“MedSave”), stealing 561 gigabytes of databases, containing data of 10,617,943 people.
Unknown
Administration and support service
Cyber Crime
IN
Unknown
109
15/01/2025
15/01/2025
15/01/2025
?
The Idols NFT
The Idols NFT contract on Ethereum suffers an exploit resulting in a loss of approximately $340K.