In the second timeline of January 2025, I collected 107 events (7.13 events/day) with a threat landscape dominated by malware with 30%, up from 18% of the previous timeline, and very close to the values of December 2024, ahead of  ransomware with 19% (it was 14% in the previous timeline) and account takeovers with 13% (it was 17% in the previous timeline), which swapped their positions.
In terms of initial access techniques, phishing emails were still the preferred weapon with 17%, up from 12%, ahead supply chain attacks (8%) and the exploitation of vulnerabilities exploiting public-facing apps (8%) that confirm their presence in the top three initial access techniques but lose 2 points (it was 8% in the previous timeline).
Cyber crime led the motivations chart with 79%, up from 71% of the previous timeline, as usual ahead of cyber espionage (12% slightly up from 11%), and hacktivism with 3%, slightly down from 4%. No events related to Cyber Warfare were recorded in this timeline.
Multiple organizations led the sectors chart with 27%, up from 21%, ahead of individuals with 17% (up from 14%) and organizations in the technical and professional space with 11%.
Besides these trends, as always the timeline is rich of interesting events, such as mega breaches and attacks against organizations in the fintech space, so my final suggestion does not change: browse the timeline for the details of the events collected in this fortnight.
Feel free to share it to support my work and spread the risk awareness across the community. And last but not least, don’t forget to connect on Linkedin, or even follow @paulsparrows on X (formerly Twitter), psparrows.bsky.social on Bluesky, or @ppasseri@Infosec.exchange on Mastodon for the latest updates.
Geo Map January H2 2025
No Data Found
No Data Found
BE NOTIFIED OF NEW POSTS
SUPPORT MY WORK! MAKE A DONATION
Creating the timelines is a very time-consuming task.
In this first quarter of 2024, threat actors have been particularly busy in exploiting vulnerabilities (0-days but also old unpatched flaws) targeting traditional remote access technologies.
A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
A one-page visual briefing on August 2026's global cyber attack landscape: 218 confirmed incidents, a rising four-in-five share driven by profit-motivated crime, and a back-to-back spike that delivered 34 attacks in just two days.
A live, continuously updated timeline of the cyber attacks reported in September 2026 — tracking threat actors, attack techniques, targeted sectors and countries as each incident is vetted and added.
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information
Researchers at QiAnXin XLab reveal that Threat actors are exploiting an unspecified zero-day vulnerability in Cambium Networks cnPilot routers to deploy a variant of the AISURU botnet called AIRASHI to carry out distributed denial-of-service (DDoS) attacks.
Malware
Multiple Industries
Cyber Crime
>1
IoT Vulnerability
2
16/01/2025
During Q3 2024
During Q3 2024
?
Multiple Organizations
Researchers at HP discover a malicious campaign delivering the VIP Keylogger, involving malicious code being embedded in image files.
Malware
Multiple Industries
Cyber Crime
>1
Phishing Email
3
16/01/2025
During Q3 2024
During Q3 2024
?
Multiple Organizations
Researchers at HP discover a malicious campaign delivering the 0bj3ctivityStealer malware, involving malicious code being embedded in image files.
Malware
Multiple Industries
Cyber Crime
>1
Phishing Email
4
16/01/2025
During Q3 2024
During Q3 2024
?
Multiple Organizations
Researchers at HP discover an HTML smuggling campaign delivering the AsyncRAT malware, which the researchers believe utilized files written with the help of GenAI.
Malware
Multiple Industries
Cyber Crime
>1
Unknown
5
16/01/2025
Since at least October 2024
During December 2024
?
Multiple Organizations
Researchers at Sekoia detail "Sneaky 2FA", a new adversary-in-the-middle (AitM) phishing kit targeting Microsoft 365 accounts with an aim to steal credentials and two-factor authentication (2FA) codes since at least October 2024.
Account Takeover
Individual
Cyber Crime
>1
Phishing Email
6
16/01/2025
During mid-November 2024
During mid-November 2024
Star Blizzard
Organizations in government, diplomacy, defense policy, international relations, and Ukraine Aid
Researchers at Microsoft reveal that the Russian nation-state actor Star Blizzard has been running a new spear-phishing campaign to compromise WhatsApp accounts of targets in government, diplomacy, defense policy, international relations, and Ukraine aid organizations.
Targeted Attack
Public admin and defence, social security
Cyber Espionage
>1
Phishing Email
7
16/01/2025
-
-
Silver Fox
Chinese-speaking regions like Hong Kong, Taiwan, and Mainland China
Researchers at Intezer reveal the details of a series of cyber attacks targeting Chinese-speaking regions like Hong Kong, Taiwan, and Mainland China with a known malware called ValleyRAT.
Malware
Individual
Cyber Espionage
CN
HK
TW
Rogue Website
8
16/01/2025
Since at least early January 2025
early January 2025
?
Organizations in the United States and Europe in the Electricity, Oil & Gas and Law Firms & Legal Services industries
Researchers at eSentire detail an ongoing campaign that leverages a malware loader called MintsLoader to distribute secondary payloads such as the StealC information stealer and a legitimate open-source network computing platform called BOINC.
Malware
Multiple Industries
Cyber Crime
US
EU
Phishing Email
9
16/01/2025
11/09/2024
-
?
Town of Ulster
The Town of Ulster discloses a ransomware attack.
Ransomware
Public admin and defence, social security
Cyber Crime
US
Unknown
10
17/01/2025
Since at least 20/06/2024
-
?
Multiple Organizations
Researchers at Socket identify a malicious PyPI package named pycord-self, which targets developers seeking Python wrappers for the Discord user API.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
11
17/01/2025
Since the end of 2024
Since the end of 2024
?
Multiple Organizations
Researchers at Trend Micro discover an IoT botnet exploiting vulnerable IoT devices such as wireless routers and IP cameras.
Malware
Multiple Industries
Cyber Crime
>1
IOT Vulnerability
Misconfiguration
12
17/01/2025
-
-
?
Multiple Organizations in Ukraine
The Computer Emergency Response Team of Ukraine (CERT-UA) warns of ongoing attempts by unknown threat actors to impersonate the cybersecurity agency by sending AnyDesk connection requests.
Targeted Attack
Multiple Industries
Cyber Espionage
UA
Social Engineering
13
17/01/2025
During October and December 2024
During October and December 2024
Donot Team (aka APT-C-35 and Origami Elephant)
Multiple Organizations in India
Researchers at Cyfirma discover “Tanzeem” and “Tanzeem Update”, an Android malware linked to the Indian APT group known as DoNot Team.
Malware
Multiple Industries
Cyber Espionage
IN
Unknown
14
17/01/2025
'Recently'
'Recently'
?
Multiple Organizations in Germany
Researchers at Cyble unveil a campaign targeting German entities, and leveraging sophisticated techniques such as DLL Sideloading, DLL Proxying, and the Sliver implant to compromise systems.
Malware
Multiple Industries
Cyber Crime
DE
Phishing Email
15
17/01/2025
18/12/2024
22/12/2024
INC Ransom
International AIDS Vaccine Initiative (IAVI)
The International AIDS Vaccine Initiative (IAVI) discloses a ransomware attack. The INC Ransom group claims responsibility.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
16
17/01/2025
During July 2024
During October 2024
?
Otelier
Hotel management platform Otelier suffers a data breach after threat actors breached its Amazon S3 cloud storage to stole millions of guests' personal information and reservations for well-known hotel brands like Marriott, Hilton, and Hyatt.
Account Takeover
Professional, scientific and technical
Cyber Crime
US
Compromised Credentials
17
17/01/2025
Between 08/01/2025 and 13/01/2025
Between 08/01/2025 and 13/01/2025
?
Individuals in California
Researchers from BforeAI and Veriti uncover a surge in phishing campaigns and fraudulent activities linked to the California wildfire, with themes ranging from insurance claims and fundraising to fire department support and restorations.
Account Takeover
Individual
Cyber Crime
US
Phishing Email
18
17/01/2025
11/10/2024
19/11/2024
?
Allegheny Health Network
Allegheny Health Network discloses that an "unauthorized user" hacked its IT vendor IntraSystems.
Unknown
Human health and social work
Cyber Crime
US
Supply Chain Compromise
19
18/01/2025
18/01/2025
18/01/2025
?
Multiple Organizations
Threat actors abuse Google ads to spread malware, using a fake Homebrew website to infect Macs and Linux devices with AmosStealer (aka 'Atomic'), an infostealer that steals credentials, browser data, and cryptocurrency wallets.
Malware
Multiple Industries
Cyber Crime
>1
Malvertising
20
19/01/2025
17/01/2025
17/01/2025
?
Blacon High School
Blacon High School announces a temporary closure after falling victim to a "ransomware attack".
Ransomware
Education
Cyber Crime
GB
Unknown
21
20/01/2025
-
-
?
Multiple Organizations
Researchers at Walmart disclose details of a new BackConnect (BC) malware that has been developed by threat actors linked to the infamous QakBot loader.
Malware
Multiple Industries
Cyber Crime
>1
Unknown
22
20/01/2025
-
16/01/2025
IntelBroker
Hewlett Packard Enterprise (HPE)
Hewlett Packard Enterprise (HPE) investigates claims of a new breach after the threat actor IntelBroker says they stole documents from the company's developer environments.
Unknown
Professional, scientific and technical
Cyber Crime
US
Unknown
23
20/01/2025
-
-
?
Individuals
Threat actors distribute close to 1,000 web pages mimicking Reddit and the WeTransfer file sharing service that lead to downloading the Lumma Stealer malware.
Malware
Individual
Cyber Crime
>1
Malvertising
SEO poisoning
Rogue Websites
Social Media
24
21/01/2025
-
21/01/2025
Silent Crow
Rostelecom
A major Russian telecommunications provider, Rostelecom, says that it is investigating a suspected cyberattack on one of its contractors after threat actors from Silent Crow claim to have leaked the company's data.
Unknown
Information and communication
Hacktivism
RU
Supply Chain Compromise
25
21/01/2025
Since at least July 2024
-
?
Multiple Organizations
Researchers from Qualys warn of a new large-scale campaign that exploits security flaws in AVTECH IP cameras and Huawei HG532 routers to rope the devices into a Mirai botnet variant dubbed Murdoc Botnet.
Malware
Multiple Industries
Cyber Crime
ID
MY
MX
TH
VN
Other Countries
IoT Vulnerability
26
21/01/2025
29/10/2024
29/10/2024
?
Unnamed internet service provider (ISP) from Eastern Asia
Cloudflare says it detected and blocked a 5.6 Terabit per second (Tbps) distributed denial-of-service (DDoS) attack, the largest ever attack to be reported to date.
DDoS
Information and communication
Unknown
Unknown
N/A
27
21/01/2025
'Recently'
'Recently'
GamaCopy (overlapping with Core Werewolf)
Russian-speaking entities
Researchers at Knownsec unveil GamaCopy, a previously unknown threat actor copying the tradecraft associated with the Kremlin-aligned Gamaredon group in its cyber attacks targeting Russian-speaking entities.
Unknown
Multiple Industries
Cyber Espionage
RU
Unknown
28
21/01/2025
During November and December 2024
During November and December 2024
STAC5777 (overlap with Storm-1811)
Multiple Organizations
Researchers at Sophos discover two separate groups of threat actors using the functionality of Microsoft’s Office 365 platform to gain access to targeted organizations with the likely goal of stealing data and deploying ransomware.
Ransomware
Multiple Industries
Cyber Crime
>1
Malspam
Social Engineering
29
21/01/2025
During November and December 2024
During November and December 2024
STAC5143 (connected with FIN7, Sangria Tempest, or Carbon Spider)
Multiple Organizations
Researchers at Sophos discover two separate groups of threat actors using the functionality of Microsoft’s Office 365 platform to gain access to targeted organizations with the likely goal of stealing data and deploying ransomware.
Ransomware
Multiple Industries
Cyber Crime
>1
Malspam
Social Engineering
30
21/01/2025
30/11/2024
-
?
Software Developers
Researchers at Hunt.io discover a campaign targeting software developers through malicious Visual Studio Code (VS Code) extensions.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
31
21/01/2025
Since at least 27/12/2024
27/12/2024
Silent Lynx
Embassies, lawyers, government-backed banks, and think tanks in Kyrgyzstan and Turkmenistan
Researchers at Seqrite discover a previously undocumented threat actor dubbed Silent Lynx, linked to cyber attacks targeting various entities in Kyrgyzstan and Turkmenistan.
Targeted Attack
Multiple Industries
Cyber Espionage
KG
TM
Phishing Email
32
21/01/2025
-
-
?
Addison Northwest School District
Addison Northwest School District (ANWSD) is hit with a cybersecurity incident.
Unknown
Education
Cyber Crime
US
Unknown
33
22/01/2025
Since November 2023
During May 2024
PlushDaemon
ipany (VPN software developed by a South Korean company)
Researchers from ESET link a previously undocumented China-aligned advanced persistent threat (APT) group named PlushDaemon to a supply chain attack targeting ipany a South Korean virtual private network (VPN) provider.
Targeted Attack
Multiple Industries
Cyber Espionage
KR
Supply Chain Compromise
34
22/01/2025
22/01/2025
22/01/2025
?
Individuals on X
Threat actors on X are exploiting the news around Ross Ulbricht to direct unsuspecting users to a Telegram channel that tricks them into run PowerShell code that infects them with malware.
Malware
Individual
Cyber Crime
>1
Social Media
35
22/01/2025
-
-
TRIPLESTRENGTH
Multiple Organizations
Google sheds light on a financially motivated threat actor named TRIPLESTRENGTH for its opportunistic targeting of cloud environments for cryptojacking and on-premise ransomware attacks.
Account Takeover
Multiple Industries
Cyber Crime
>1
Compromised Credentials
36
22/01/2025
18/01/2025
18/01/2025
?
Conduent
American business services and government contractor Conduent confirms that a recent outage resulted from what it described as a "cyber security incident."
Unknown
Administration and support service
Cyber Crime
US
Unknown
37
23/01/2025
-
-
Unknown Threat Actors
Unknown Organization(s)
SonicWall alerts customers of CVE-2025-23006, a critical security flaw impacting its Secure Mobile Access (SMA) 1000 Series appliances that it said has been likely exploited in the wild as a zero-day.
Unknown
Unknown
Unknown
Unknown
Security Appliance Vulnerability
38
23/01/2025
Between mid-2023 and at least mid-2024
Between mid-2023 and at least mid-2024
?
Organizations in the semiconductor, energy, manufacturing (marine, solar panels, heavy machinery), and IT sectors.
Researchers at Black Lotus Labs discover a malicious campaign specifically targeting Juniper edge devices, many acting as VPN gateways, with malware dubbed J-magic that starts a reverse shell only if it detects a “magic packet” in the network traffic.
Malware
Multiple Industries
Cyber Crime
>1
Security Appliance Vulnerability
39
23/01/2025
'Over recent months'
'Over recent months'
Threat Actors from North Korea
Multiple Organizations in the U.S.
The FBI warns that North Korean IT worker schemes are stealing data to extort their victims as part of efforts to generate revenue for the Democratic People's Republic of Korea (DPRK).
Targeted Attack
Multiple Industries
Cyber Crime
US
Social Engineering
40
23/01/2025
Since 2021
Since at least 29/01/2022
“Crazy Evilˮ
Cryptocurrency Users and Influencers
Researchers at Recorded Future identify a versatile and adaptable Russian-speaking cybercriminal group engaged in digital asset theft, identity fraud, and the global proliferation of information stealer malware, operating under the moniker “Crazy Evilˮ.
Malware
Fintech
Cyber Crime
>1
Social Media
41
23/01/2025
During January 2025
During January 2025
?
Windows users in Argentina, Colombia, the United States, the Philippines, and other countries around the world
Researchers at Netskope discover a new malware campaign that leverages fake CAPTCHA verification checks to deliver the infamous Lumma information stealer.
Malware
Individual
Cyber Crime
AR
CO
PH
US
Other Countries
Rogue Website
42
23/01/2025
-
-
Andariel
Multiple Organizations in North Korea
Researchers at AHnLab reveal that the North Korean threat group Andariel has been using a technique called RID hijacking that tricks Windows into treating a low-privileged account as one with administrator permissions.
Malware
Multiple Industries
Cyber Espionage
KR
OS Vulnerability
43
23/01/2025
23/01/2025
23/01/2025
Threat Actors from North Korea?
Phemex
Singapore-based cryptocurrency platform Phemex is forced to pause some of its operations after a suspected cyberattack led to the theft of more than $85 million in digital coins.
Unknown
Fintech
Cyber Crime
SG
Software Vulnerability
44
23/01/2025
'Recently'
'Recently'
?
Multiple Organizations
Researchers at Sucuri discover a campaign redirecting WordPress traffic to malicious sites.
Malicious Script Injection
Multiple Industries
Cyber Crime
>1
Public-facing App Vulnerability
45
23/01/2025
-
-
Unknown Threat Actor(s)
Unknown Organization(s) in the U.S.
CISA and the FBI warn that threat actors are still exploiting Ivanti Cloud Service Appliances (CSA) security flaws, including CVE-2024-8963, CVE-2024-8190, CVE-2024-9379 and CVE-2024-9380 patched since September to breach vulnerable networks.
Unknown
Unknown
Unknown
US
Security Appliance Vulnerability
46
24/01/2025
-
-
Unknown Threat Actor(s)
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2020-11023, a now-patched security flaw impacting the popular jQuery JavaScript library to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
Public-facing App Vulnerability
47
24/01/2025
?
Inexperienced Threat Actors
Researchers at CloudSEK discover a new campaign involving a Trojanized version of the XWorm malware, compromising over 18,459 devices globally.
Malware
Individual
Cyber Crime
IN
RU
UA
US
TU
Other Countries
Supply Chain Compromise
48
24/01/2025
?
Unknown Organization(s)
Researchers at Arctic Wolf reveal that threat actors are believed to be exploiting CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728, three recently fixed SimpleHelp Remote Monitoring and Management (RMM) software vulnerabilities to gain initial access to target networks.
Unknown
Multiple Industries
Unknown
>1
Software Vulnerability
49
24/01/2025
-
-
?
Mobile Users in the U.S.
Researchers at Zimperium discover a phishing campaign impersonating the United States Postal Service (USPS), exclusively targeting mobile devices, and employing sophisticated social engineering tactics and a never-before-seen means of obfuscation to deliver malicious PDF files designed to steal credentials and compromise sensitive data.
Account Takeover
Individual
Cyber Crime
US
SMS
50
24/01/2025
-
-
?
Individuals
Researchers at McAfee discover a campaign exploiting GitHub to deliver the LummaStealer malware in disguise of cracks, hacks, and crypto tools.
Malware
Individual
Cyber Crime
>1
Malvertising
51
24/01/2025
24/01/2025
24/01/2025
?
Matagorda County
Matagorda County discloses a cyber attack “involving a virus that has affected several internal systems.”
Malware
Public admin and defence, social security
Cyber Crime
US
Unknown
52
24/01/2025
-
29/10/2024
RansomHub
HCF Management
HCF Management healthcare facilities confirm a ransomware attack from the RansomHun group, with more than 70,000 patients affected.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
53
24/01/2025
-
-
Medusa
Hospital El Cruce
The Hospital El Cruce is hit with a Medusa ransomware attack.
Ransomware
Human health and social work
Cyber Crime
AR
Unknown
54
25/01/2025
-
21/01/2025
b0nd
TalkTalk
UK telecommunications company TalkTalk investigates a third-party supplier data breach after a threat actor begins selling alleged customer data on a hacking forum. The data was allegedly stolen from the Ascendon SaaS platform.
Unknown
Information and communication
Cyber Crime
GB
Supply Chain Compromise
55
26/01/2025
26/01/2025
26/01/2025
Handala
Maagar-Tec
The pro-Palestinian group called Handala reportedly breaches emergency systems used in Israeli schools, after compromising Maagar-Tec, and broadcasts rocket sirens and Arabic songs that Israel’s cyber agency called supportive of “terrorism.”
Unknown
Professional, scientific and technical
Hacktivism
IL
Unknown
56
26/01/2025
26/01/2025
26/01/2025
?
Marposs
Marposs is hit with a ransomware attack
Ransomware
Unknown
Cyber Crime
IT
Unknown
57
27/01/2025
-
-
?
Amazon Users
Researchers at Palo Alto Networks discover a campaign using PDF documents announcing an expired Amazon Prime membership.
Account Takeover
Wholesale and retail
Cyber Crime
US
Phishing Email
58
27/01/2025
End of January 2025
End of January 2025
?
Multiple Organizations
Researchers at c/side discover over 10,000 WordPress sites showing fake Google browser update pages in the browser of visitors via an iframe, delivering cross-platform malware, both AMOS (Atomic macOS Stealer), which targets Apple users, and SocGholish, which targets Windows users.
Malicious Script Injection
Multiple Industries
Cyber Crime
>1
WordPress Plugin Vulnerability
59
27/01/2025
-
-
Unknown Threat Actor(s)
Unknown Organization(s)
Apple releases security updates to fix CVE-2025-24085 , this year's first zero-day vulnerability, tagged as actively exploited in attacks targeting iPhone users.
Unknown
Unknown
Unknown
Unknown
OS Vulnerability
60
27/01/2025
27/01/2025
27/01/2025
?
DeepSeek
Chinese AI platform DeepSeek disables registrations on its DeepSeek-V3 chat platform due to an ongoing "large-scale" cyberattack targeting its services.
DDoS
Professional, scientific and technical
Cyber Crime
CN
N/A
61
27/01/2025
27/01/2025
27/01/2025
?
Frederick Health Medical Group
Frederick Health Medical Group warns that there will be delays in service as it is hit by a ransomware attack.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
62
27/01/2025
26/01/2025
26/01/2025
?
South African Weather Service (SAWS)
A cyberattack forces the government-run South African Weather Service (SAWS) offline, limiting access to a critical service used by the country’s airlines, farmers and allies.
Unknown
Public admin and defence, social security
Cyber Crime
ZA
Unknown
63
27/01/2025
Mid-January 2025
Mid-January 2025
?
Individuals in the U.K.
Threat actors are leveraging a highly convincing SMS phishing (smishing) scam, impersonating Royal Mail to deceive victims into providing sensitive personal and financial information.
Account Takeover
Individual
Cyber Crime
GB
SMS
64
27/01/2025
-
13/01/2025
?
Conad
Conad, an important wholesale chain in Italy, is hit with a Lynx ransomware attack.
Ransomware
Wholesale and retail
Cyber Crime
IT
Unknown
65
27/01/2025
-
-
Kill Security (alias KillSec)
Let’s Secure Insurance Brokers
Let’s Secure Insurance Brokers is hit with a ransomware attack.
Ransomware
Finance and insurance
Cyber Crime
IN
Misconfiguration
66
27/01/2025
-
-
?
More than 570 computers linked to Mexico's government
Threat actors infect more than 570 computers linked to Mexico's government domain gob.mx with infostealer malware, exposing sensitive data and login credentials.
Malware
Public admin and defence, social security
Cyber Crime
MX
Public-facing App Vulnerability
67
28/01/2025
Since July 2024
During November 2024
?
Individuals in Poland and Germany
Researchers at Cisco discover an ongoing malicious campaign operated by a financially motivated threat actor targeting users, predominantly in Poland and Germany, with different payloads, including Agent Tesla, Snake Keylogger, and a new undocumented backdoor called TorNet, dropped by PureCrypter malware.
Malware
Individual
Cyber Crime
DE
PL
Phishing Email
68
28/01/2025
Since 12/01/2025
12/01/2025
?
Taxpayers in the U.K.
Researchers at Proofpoint discover a campaign impersonating HM Revenue & Customs (HMRC) using “account update” lures impersonating HMRC.
Account Takeover
Individual
Cyber Crime
GB
Phishing Email
69
28/01/2025
Since 16/01/2025
16/01/2025
?
Taxpayers in the U.S.
Researchers at Proofpoint discover a tax-themed campaign impersonating Intuit.
Account Takeover
Individual
Cyber Crime
US
Phishing Email
70
28/01/2025
Since 18/12/2024
18/12/2024
?
Organizations in Switzerland
Researchers at Proofpoint discover a campaign targeting Swiss organizations, with messages purported to be federal tax payment reminders and impersonated the Federal Tax Administration.
Account Takeover
Multiple Industries
Cyber Crime
CH
Phishing Email
71
28/01/2025
Since 03/01/2025
03/01/2025
?
Taxpayers in Australia
Researchers at Proofpoint discover a campaign impersonating myGov, the Australian government services portal.
Account Takeover
Individual
Cyber Crime
AU
Phishing Email
72
28/01/2025
Since 16/01/2025
16/01/2025
?
Multiple Organizations
Researchers at Proofpoint discover a campaign impersonating a tax software solutions organization to deliver the Rhadamanthys malware.
Malware
Individual
Cyber Crime
>1
Phishing Email
73
28/01/2025
Since 27/01/2025
27/01/2025
?
Unknown Organizations(s)
Researchers at Greynose reveal that threat actors are exploiting a critical command injection vulnerability in Zyxel CPE Series devices, tracked as CVE-2024-40891, unpatched since last July.
Unknown
Unknown
Unknown
Unknown
IoT Vulnerability
74
28/01/2025
-
-
?
Multiple Organizations
Researchers at Akamai discover a new variant of the Mirai-based botnet malware Aquabot, actively exploiting CVE-2024-41710, a command injection vulnerability in Mitel SIP phones.
Malware
Multiple Industries
Cyber Crime
>1
IoT Vulnerability
75
28/01/2025
-
-
?
Smiths Group
London-based engineering giant Smiths Group discloses a security breach after unknown attackers gained access to the company's systems.
Unknown
Professional, scientific and technical
Cyber Crime
GB
Unknown
76
28/01/2025
-
nam3l3ess?
?
CenterPoint Energy
CenterPoint Energy, a large Texas energy company confirms it is investigating reports of stolen customer data that has been published on a cybercriminal forum after it was allegedly taken during the 2023 MOVEit breach.
Unknown
Electricity, gas steam, air conditioning
Cyber Crime
US
Public-facing App Vulnerability
77
28/01/2025
Since December 2022
During March 2024
NGC4020
Undisclosed Organization
Researchers at Solar warn of a new cyberespionage campaign targeting local chemical, food, and pharmaceutical enterprises.
Targeted Attack
Unknown
Cyber Espionage
RU
Public-facing App Vulnerability
78
28/01/2025
05/07/2024
08/10/2024
?
Berman & Rabin
Law firm Berman & Rabin notifies roughly 152,000 individuals that their personal information was compromised in a July 2024 ransomware attack.
Ransomware
Professional, scientific and technical
Cyber Crime
US
Unknown
79
28/01/2025
Since May 2024
Since May 2024
Arcus Media
Multiple Organizations
Researchers at Halcyon reveal the details of the increasingly sophisticated techniques used by the Arcus Media ransomware group.
Ransomware
Multiple Industries
Cyber Crime
>1
Phishing Email
80
28/01/2025
Since at least late November 2024
Late November 2024
Threat actors from North Korea
macOS Users
Researchers at Hunt.io uncover a surge in attacks leveraging SparkRAT, a cross-platform Remote Access Trojan (RAT) written in GoLang.
Malware
Individual
Cyber Crime
>1
Rogue Website
81
28/01/2025
-
-
IntelBroker
Hewlett Packard Enterprise (HPE)
The threat actor IntelBroker claims to have targeted Hewlett-Packard Enterprise (HPE) again, having access to the company’s internal infrastructure.
Unknown
Professional, scientific and technical
Cyber Crime
US
Unknown
82
29/01/2025
-
-
UAC-0063, overlapping with APT28, a.k.a. Blue Athena, BlueDelta, Fancy Bear, Fighting Ursa, Forest Blizzard, FROZENLAKE, Iron Twilight, ITG05, Pawn Storm, Sednit, Sofacy, and TA422.
Organizations in Central Asia and European countries
HCF Management healthcare facilities confirm a ransomware attack from the RansomHub group, with more than 70,000 patients affected.
Targeted Attack
Multiple Industries
Cyber Espionage
>1
Phishing Email
83
29/01/2025
End of January 2025
End of January 2025
?
Users of the Solana blockchain
Threat actors compromise the Windows version of the DogWifTools software for promoting meme coins on the Solana blockchain in a supply-chain attack that drained users' wallets.
Malware
Fintech
Cyber Crime
>1
Supply Chain Compromise
84
29/01/2025
Since May 2024
-
Threat Actor from China
High-value targets in South Asia, including a telecommunications organization
Researchers at Palo Alto unveil CL-STA-0048, a cluster of activities targeting high-value targets in South Asia, including a telecommunications organization.
Targeted Attack
Multiple Industries
Cyber Espionage
>1
Public-facing App Vulnerability
85
29/01/2025
Since November 2024
During December 2024
Lazarus Group
Cryptocurrency and Technology Developers
Researchers at SecurityScorecard uncover "Phantom Circuit", targeting cryptocurrency and technology developers, planting backdoors in clones of legitimate software packages and open source tools, and employing advanced obfuscation techniques through proxy servers.
Targeted Attack
Fintech
Cyber Crime
>1
Supply Chain Compromise
86
29/01/2025
26/01/2025
26/01/2025
?
New York Blood Center (NYBC)
​The New York Blood Center (NYBC), one of the world's largest independent blood collection and distribution organizations, says a Sunday ransomware attack forced it to reschedule some appointments.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
87
29/01/2025
11/01/2024
23/02/2024
?
NorthBay Healthcare Corporation
NorthBay Healthcare Corporation in California notifies 569,012 people of a breach that occurred between January 11 to April 1, 2024.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
88
30/01/2025
-
-
?
Multiple Organizations
Researchers at Malwarebytes discover a malicious campaign ​using Google search advertisements to promote phishing sites that steal advertisers' credentials for the Microsoft Ads platform.
Account Takeover
Multiple Industries
Cyber Crime
>1
Malvertising
89
30/01/2025
During 2024
During 2024
?
Banking Users in Brazil
Researchers at Fortinet discover a multi-stage campaign delivering the Coyote Banking Trojan, primarily targeting users in Brazil, seeking to harvest sensitive information from over 70 financial applications and numerous websites.
Malware
Finance and insurance
Cyber Crime
BR
Unknown
90
30/01/2025
'Recently'
'Recently'
?
Crypto Users
Researchers at Cyble identify multiple suspicious websites impersonating DeepSeek, linked to crypto phishing schemes and fraudulent investment scams.
Account Takeover
Scam
Malware
Fintech
Cyber Crime
>1
Rogue Website
91
30/01/2025
Since mid-2024
Since mid-2024
Individuals in Malaysia and Brunei
Researchers at Kaspersky reveal that threat actors are using fake wedding invitations targeting users in Malaysia and Brunei to distribute a newly discovered Android malware called Tria.
Malware
Individual
Cyber Crime
BN
MY
Instant Messaging App
92
30/01/2025
14/10/2024
02/01/2025
?
Community Health Center (CHC)
Community Health Center (CHC), a leading Connecticut healthcare provider, notifies over 1 million patients of a data breach that impacted their personal and health data.
Unknown
Human health and social work
Cyber Crime
US
Unknown
93
30/01/2025
21/08/2024
18/12/2024
BianLian
Mizuno USA
​Mizuno USA, a subsidiary of Mizuno Corporation, one of the world's largest sporting goods manufacturers, confirms in data breach notification letters that unknown attackers stole files from its network between August and October 2024. The BianLian claims responsibility for the attack.
Ransomware
Manufacturing
Cyber Crime
US
Unknown
94
30/01/2025
23/08/2024
30/12/2024
Akira
Yazoo Valley Electric Power Association
Yazoo Valley Electric Power Association, an electric utility serving multiple counties in Mississippi discloses to suffer an attack by cybercriminals last summer in an incident that exposed the information of more than 20,000 residents. The Akira ransomware gang claims responsibility for the attack.
Ransomware
Electricity, gas steam, air conditioning
Cyber Crime
US
Unknown
95
30/01/2025
-
17/10/2024
?
Globe Life
Insurance company Globe Life notifies 850,000 individuals of a data breach that might have involved their personal, health, and insurance information.
Unknown
Finance and insurance
Cyber Crime
US
Unknown
96
30/01/2025
-
-
?
Individuals in Namibia
Scammers are using the likeness of Namibia's former first lady, Monica Geingos, to trick people into falling for investment scams.
Scam
Individual
Cyber Crime
NA
Social Media
97
30/01/2025
16/01/2025
-
0mid16B
Apex Custom Software
Apex Custom Software is hit with a ransomware attack.
Ransomware
Professional, scientific and technical
Cyber Crime
US
Unknown
98
31/01/2025
-
During December 2024
?
Around 90 journalists and civil society members
Meta-owned WhatsApp says it disrupted a campaign that involved the use of the Paragon spyware to target journalists and civil society members.
Targeted Attack
Individual
Cyber Espionage
>1
Instant Messaging App
99
31/01/2025
Between 14/01/2025 and 28/01/2025
28/01/2025
?
Multiple Organizations
Researchers at Jscrambler uncover a new batch of web skimmer infections affecting at least 17 websites, including casio.co.uk.
Malicious Script Injection
Wholesale and retail
Cyber Crime
>1
Public-facing App Vulnerability
100
31/01/2025
'Over the past few weeks'
'Over the past few weeks'
?
High-profile X accounts
Researchers at Sentinel One discover an active phishing campaign targeting high-profile X accounts in an attempt to hijack and exploit them for fraudulent activity.
Account Takeover
Individual
Cyber Crime
US
Unknown
101
31/01/2025
'Recently'
'Recently'
?
Multiple Organizations
Researchers at Forcepoint uncover a malware campaign delivering a remote access trojan (RAT) named AsyncRAT by making use of Python payloads and TryCloudflare tunnels.
Malware
Multiple Industries
Cyber Crime
>1
Phishing Email
102
31/01/2025
During January 2025
During January 2025
Sector 16
Oil and gas facility control panels in the U.S.
Researchers at Cyble identify Sector 16, a new pro-Russian hacktivist group targeting into oil and gas facility control panels in the U.S.
Unknown
Electricity, gas steam, air conditioning
Hacktivism
US
OT Vulnerability
103
31/01/2025
-
-
?
Tata Technologies
Tata Technologies Ltd. suspends some of its IT services following a ransomware attack that impacted the company network.
Ransomware
Professional, scientific and technical
Cyber Crime
IN
Unknown
104
31/01/2025
During January 2025
During January 2025
Rezet, or Rare Wolf
Chemical, food, and pharmaceutical enterprises in Russia
Researchers at F.A.C.C.T. warn of a new cyberespionage campaign targeting local chemical, food, and pharmaceutical enterprises, attributed to a state-backed hacker group tracked as Rezet, or Rare Wolf.
Targeted Attack
Multiple Industries
Cyber Espionage
RU
Phishing Email
105
31/01/2025
?
Late December 2024
DragonForce
Asheville Eye Associates
Asheville Eye Associates says the personal and medical information of a subset of its patients was compromised as a result of a cybersecurity incident. The DragonForce claims responsibility for the attack, claiming to have stolen hundreds of gigabytes of data.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
106
31/01/2025
27/05/2024
30/05/2024
?
Delta County Memorial Hospital
Non-profit hospital district Delta County Memorial Hospital informs that threat actors had compromised the personal information of 148,363 people in a May 2024 cyberattack.
Unknown
Human health and social work
Cyber Crime
US
Unknown
107
31/01/2025
16/01/2025
-
DragonForce
Heart Centre
Heart Centre in Australia is hit with a DragonForce ransomware attack.
October 2026 Cyber Attacks Timeline
Mega Breaches in 2026
August 2026 Cyber Attacks Statistics Infographic
H1 2024 Cyber Attacks Statistics
September 2026 Cyber Attacks Timeline