In the first timeline of February 2025, I collected 115 events (7.67 events/day) with a threat landscape dominated by malware with 30%, the same value of the previous timeline, ahead of targeted attacks with 16% and account takeovers with 10%, and confirming a drop of Ransomware at fourth place with 8%.
In terms of initial access techniques, phishing was still the preferred weapon with 12%, down from 17%, ahead of the exploitation of vulnerabilities in public-facing apps (9%) and in generic software (8%).
Cyber crime led the motivations chart with “only” 60% down from 79%, as usual ahead of cyber espionage (21% up from 12%), and hacktivism with a risible impact. Even in this timeline, no events related to Cyber Warfare were recorded.
Multiple organizations led the sectors chart with 22%, down from 27%, ahead of governments with 9% and organizations in the technical sector with 8%.
Besides these trends, as always the timeline is rich of interesting events, such as mega breaches and attacks against organizations in the fintech space, so my final suggestion does not change: browse the timeline for the details of the events collected in this fortnight.
Feel free to share it to support my work and spread the risk awareness across the community. And last but not least, don’t forget to connect on Linkedin, or even follow @paulsparrows on X (formerly Twitter), psparrows.bsky.social on Bluesky, or @ppasseri@Infosec.exchange on Mastodon for the latest updates.
Geo Map February H1 2025
No Data Found
No Data Found
BE NOTIFIED OF NEW POSTS
SUPPORT MY WORK! MAKE A DONATION
Creating the timelines is a very time-consuming task.
In this first quarter of 2024, threat actors have been particularly busy in exploiting vulnerabilities (0-days but also old unpatched flaws) targeting traditional remote access technologies.
A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
A live, continuously updated timeline of the cyber attacks reported in September 2026 — tracking threat actors, attack techniques, targeted sectors and countries as each incident is vetted and added.
A one-page visual briefing on August 2026's global cyber attack landscape: 218 confirmed incidents, a rising four-in-five share driven by profit-motivated crime, and a back-to-back spike that delivered 34 attacks in just two days.
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information
Researchers at Positive Technologies discover a campaign where threat actors are taking advantage of the rise in popularity of DeepSeek to promote two malicious infostealer packages on the Python Package Index (PyPI), "deepseeek" and "deepseekai", where they impersonated developer tools for the AI platform.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
2
02/02/2025
20/10/2020
20/10/2020
?
Western Dental
Western Dental discloses a ransomware attack.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
3
03/02/2025
-
-
Unknown Threat Actor(s)
Unknown Organization(s)
Google patches CVE-2024-53104, a zero-day kernel vulnerability exploited in the wild. Few days later the U.S CISA orders Federal Agencies to patch the vulnerability.
Unknown
Unknown
Unknown
Unknown
OS Vulnerability
4
03/02/2025
-
-
Threat Actors from North Korea
Users of GitHub
Researchers at Sentinel One discover 'FlexibleFerret' a new variant of a macOS malware family that state-sponsored North Korean threat actors have used in threat campaigns involving fake job interviews dubbed “Contagious Interview”.
Targeted Attack
Multiple Industries
Cyber Crime
>1
Social Engineering
5
03/02/2025
-
-
Silver Fox APT?
High-value individuals within organizations, especially those in finance, accounting, and sales,
Researchers at Morphisec discover a new version of the sophisticated ValleyRAT malware distributed through various channels including phishing emails, instant messaging platforms and compromised websites.
Researchers at Intezer and Solis unveil the latest campaign from the Vietnamese XE Group threat actor, exploiting CVE-2024-57968, and CVE-2025-25181, two zero-day vulnerabilities in VeraCore, to deploy webshells for maintaining unauthorized access to compromised systems.
Malware
Unknown
Cyber Crime
>1
Public-facing App Vulnerability
7
03/02/2025
01/02/2025
01/02/2025
?
Bohemia Interactive
A DDoS attack targets Bohemia Interactive's infrastructure, preventing players of DayZ and Arma Reforger from playing the games online.
DDoS
Arts entertainment, recreation
Cyber Crime
CZ
N/A
8
03/02/2025
Since 19/12/2024
Since 19/12/2024
?
Multiple Organizations
Researchers from TEHTRIS discover a campaign delivering LegionLoader, a sophisticated malware downloader also known as Satacom, CurlyGate, and RobotDropper, accumulating over 2,000 samples in just a few weeks.
Malware
Multiple Industries
Cyber Crime
BR
Other Countries
Public-facing App Vulnerability
9
03/02/2025
'Recently'
'Recently'
?
GrubHub
Food delivery company GrubHub discloses a data breach impacting the personal information of an undisclosed number of customers, merchants, and drivers after attackers breached its systems using a service provider account.
Account Takeover
Accommodation and food service
Cyber Crime
US
Compromised Credentials
10
03/02/2025
During 2022
-
Threat Actors from Russia
British prime minister, Keir Starmer
Russia is suspected of compromising the personal email account of the British prime minister, Keir Starmer, before he entered office, according to a recently published book.
Account Takeover
Individual
Cyber Crime
GB
Unknown
11
04/02/2025
Since at least September 2024
During September 2024
Threat Actors from Russia
Governmental and non-governmental organizations in Ukraine
Researchers at Trend Micro discover a campaign exploiting the 7-Zip CVE-2025-0411 vulnerability to target both the Ukrainian government and other Ukrainian organizations in a SmokeLoader campaign that was likely deployed by Russian cybercrime groups.
Malware
Multiple Industries
Cyber Espionage
UA
Phishing Email
12
04/02/2025
Since November 2021
-
“boltdb-go”
Multiple Organizations
Researchers at Socket discover a software supply chain attack targeting the Go ecosystem that involves a malicious package capable of granting the adversary remote access to infected systems. The package is a typosquat of the legitimate BoltDB database module.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
13
04/02/2025
Since 28/12/2024
-
?
Multiple Organizations
Researchers at Cycode detail three malicious npm packages – serve-static-corell, openssl-node, and next-refresh-token – that harbor obfuscated code to collect system metadata and run arbitrary commands on the infected host.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
14
04/02/2025
-
-
Unknown Threat Actor(s)
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2024-45195, a forced browsing vulnerability in Apache OFBiz to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
Public-facing App Vulnerability
15
04/02/2025
-
-
Unknown Threat Actor(s)
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2024-29059, an information disclosure vulnerability in Microsoft .NET framework to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
Software Vulnerability
16
04/02/2025
-
-
Unknown Threat Actor(s)
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2018-9276, an operating system command injection vulnerability in Paessler PRTG Network Monitor, to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
Software Vulnerability
17
04/02/2025
-
-
Unknown Threat Actor(s)
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2018-19410 (CVSS score: 9.8) - A local file inclusion vulnerability in Paessler PRTG Network Monitor, to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
Software Vulnerability
18
04/02/2025
Since at least late 2024
Late 2024
?
Android and iOS users
Researchers at Kaspersky unveil a new malware campaign dubbed “SparkCat” carried out via a malicious SDK/framework embedded to steal crypto wallet recovery phrases.
Malware
Fintech
Cyber Crime
>1
Rogue App
19
04/02/2025
Since mid-November 2024
-
Evasive Panda, a.k.a. DaggerFly
Multiple Organizations
Researchers at Fortinet reveal that the Chinese group Evasive Panda is hijacking the SSH daemon on network appliances by injecting the "ELF/Sshdinjector.A!tr" malware into the process for persistent access and covert operations.
Targeted Attack
Multiple Industries
Cyber Espionage
>1
Security Appliance Vulnerability
20
04/02/2025
-
-
TAG-124 (infrastructure used by multiple threat actors including the Rhysida ransomware, the Interlock ransomware, TA866/Asylum Ambuscade, SocGholish, D3F@CK Loader, TA582, and others
Multiple Organizations
Researchers at Recorded Future unveil a sophisticated cyber campaign orchestrated by the threat group TAG-124 compromising over 1,000 WordPress websites to deploy multiple malicious payloads.
Malware
Multiple Industries
Cyber Crime
>1
Public-facing App Vulnerability
21
04/02/2025
-
-
Kimsuky a.k.a. APT43, Black Banshee, Emerald Sleet, Sparkling Pisces, Springtail, TA427, and Velvet Chollima
Multiple Organizations in South Korea
Researchers at AhnLab reveal that the North Korea-linked nation-state group known as Kimsuky has been observed conducting spear-phishing attacks to deliver an information stealer malware named forceCopy, a known trojan dubbed PEBBLEDASH and a custom version of an open-source Remote Desktop utility named RDP Wrapper.
Malware
Multiple Industries
Cyber Espionage
KR
Phishing Email
22
04/02/2025
-
-
?
Russian Organizations Across Various Industries
Researchers at BI.ZONE unveil a large‑scale campaign targeting Russian organizations across various industries, using NOVA stealer, a new commercial fork of SnakeLogger.
Malware
Multiple Industries
Cyber Crime
RU
Phishing Email
23
04/02/2025
-
-
Rezet, a.k.a. Rare Wolf
Chemical, Food, and Pharmaceutical Enterprises in Russia
Researchers at F.A.C.C.T. warn of a new cyberespionage campaign targeting chemical, food, and pharmaceutical enterprises in Russia. The attacks are attributed to a state-backed group tracked as Rezet, or Rare Wolf.
Targeted Attack
Multiple Industries
Cyber Espionage
RU
Unknown
24
04/02/2025
Since December 2022
During March 2024
NGC4020
Russian Industrial Facilities
Researchers at Solar disclose a campaign against Russian industrial facilities, carried out from a newly identified state-sponsored group, tracked as APT NGC4020, reportedly exploiting a vulnerability in DameWare Mini Remote Control.
Targeted Attack
Multiple Industries
Cyber Espionage
RU
Software Vulnerability
25
04/02/2025
-
-
?
Indian Users of Mobile Banking
Researchers at Zimperium discover "FatBoyPanel", a mobile malware campaign consisting of almost 900 malware samples primarily targeting users of Indian banks.
Malware
Finance and insurance
Cyber Crime
IN
Instant Messaging App
26
04/02/2025
Since January 2025
During January 2025
GreenSpot APT
163.com Users
Researchers at Hunt.io uncover a new campaign from the Taiwanese GreenSpot APT, targeting 163.com users with fake download pages and spoofed domains.
Account Takeover
Individual
Cyber Espionage
CN
Phishing Email
27
04/02/2025
Since at least mid-December 2024
During Mid-December 2024
?
Users in the Crypto Space
Researchers at Proofpoint discover a campaign using video-based abuse (VidSpam) to promote Bitcoin scams.
Scam
Fintech
Cyber Crime
>1
MMS
28
04/02/2025
-
-
?
Social Security recipients
Researchers at Silent Push reveal that it's seeing a rise in the use of the ScreenConnect RMM software on bulletproof hosts as a way for threat actors to gain access and control victim endpoints.
Malware
Individual
Cyber Crime
US
Social Engineering
29
04/02/2025
31/10/2024
14/11/2024
?
McKinney
McKinney, a large suburb of Dallas, informs thousands of residents that a cyberattack in October exposed sensitive information.
Unknown
Public admin and defence, social security
Cyber Crime
US
Unknown
30
04/02/2025
Since at least 13/11/2024
13/11/2024
APT37 (a.k.a. ScarCruft)
Multiple Organizations in South Korea
Researchers at Genians discover a new campaign carried out by the North Korea-aligned APT37 (a.k.a. ScarCruft), distributing booby-trapped documents via spear-phishing to deploy the RokRAT malware, as well as propagate them to other targets over group chats through the K Messenger platform from the compromised user's computer.
Targeted Attack
Multiple Industries
Cyber Espionage
KR
Phishing Email
31
04/02/2025
-
-
?
ACAO (Arab Civil Aviation Organization)
Researchers from Resecurity identify threat actors targeting the ACAO (Arab Civil Aviation Organization). As a result of a successful SQL injection exploitation in a vulnerable web application, records of staff/members and their credentials were exfiltrated.
SQLi
Extraterritorial orgs and bodies
Cyber Crime
INT
Public-facing App Vulnerability
32
04/02/2025
04/02/2025
04/02/2025
?
Ionic Money
Ionic Money confirms a serious security breach, with estimated losses exceeding $8.6 million.
Fake Collateral
Fintech
Cyber Crime
N/A
Social Engineering
33
05/02/2025
Between October 2024 and late January 2025
Between October 2024 and late January 2025
UAC-0006
Ukraine's PrivatBank customers
The financially motivated threat actor known as UAC-0006 has been attributed as behind a payment-themed phishing campaign dubbed GetSmoked targeting Ukraine's PrivatBank to distribute the SmokeLoader malware.
Malware
Finance and insurance
Cyber Crime
UA
Phishing Email
34
05/02/2025
Since at least early January 2025
Early January 2025
?
Multiple Organizations
Researchers at eSentire are exploiting a six year old vulnerability, CVE-2019-18935, in Progress Telerik UI for ASP.NET AJAX to deliver reverse shells and the JuicyPotatoNG privilege escalation tool.
Malware
Multiple Industries
Cyber Crime
>1
IOT Vulnerability
35
05/02/2025
17/01/2025
17/01/2025
?
Seven Italians and Individuals in Belgium, Greece, Latvia, Lithuania, Austria, Cyprus, Czech Republic, Denmark, Germany, the Netherlands, Portugal, Spain and Sweden
The Italian government reveals that seven Italians and victims in more than a dozen other European countries were targeted with spyware as part of a broad hacking campaign previously revealed by WhatsApp.
Targeted Attack
Individual
Cyber Espionage
AT
CY
CZ
BE
DE
DK
ES
GR
IT
LT
LV
NL
PT
SE
Instant Messaging App
36
05/02/2025
-
-
Lazarus Group
Multiple Organizations
Researchers at BitDefender warn of an active campaign by the North Korea-linked Lazarus Group, targeting organizations by capturing credentials and delivering malware through fake LinkedIn job offers.
Targeted Attack
Multiple Industries
Cyber Espionage
>1
Social Engineering
37
05/02/2025
-
-
?
At Least 150 Targets in Education, Healthcare, and Government
Researchers at Abnormal. Security discover a helpdesk phishing campaign targeting Microsoft Active Directory Federation Services (ADFS) using spoofed login pages to steal credentials and bypass multi-factor authentication protections.
Account Takeover
Multiple Industries
Cyber Crime
>1
Phishing Email
38
05/02/2025
'Recently'
'Recently'
Russian-speaking Threat Actors
Individuals
Researchers at Malwarebytes discover a malicious campaign using a cloned University site to evade ad detection and distributing malware disguised as a fake Cisco AnyConnect installer.
Malware
Individual
Cyber Crime
>1
Malvertising
39
05/02/2025
-
-
?
Multiple Organizations
Researchers at Cyble discover a sophisticated malware attack that uses dual injection techniques to bypass Google Chrome’s App-Bound Encryption.
Malware
Multiple Industries
Cyber Crime
>1
Phishing Email
40
05/02/2025
During December 2024
09/12/2024
?
Avery
Avery, the world’s largest supplier of labels says a ransomware attack in December prompted an investigation that led to the discovery of a data breach impacting the information of about 67,000 customers.
Ransomware
Manufacturing
Cyber Crime
US
Unknown
41
05/02/2025
18/07/2024
05/01/2025
?
Avery
Avery, the world’s largest supplier of labels says a ransomware attack in December prompted an investigation that led to the discovery of a data breach impacting the information of about 67,000 customers.
Malicious Script Injection
Manufacturing
Cyber Crime
US
Unknown
42
05/02/2025
Since mid-January
Since mid-January
?
Multiple Organizations
Researchers at Sophos observe email phishing attacks leveraging scalable vector graphics (SVG) files to bypass spam and phishing protections.
Malware
Multiple Industries
Cyber Crime
>1
Phishing Email
43
06/02/2025
-
-
Unknown Threat Actor(s)
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2024-21413, a Microsoft Outlook Improper Input Validation Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
Unknown
Unknown
Unknown
US
Public-facing App Vulnerability
44
06/02/2025
-
-
Unknown Threat Actor(s)
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2022-23748, a Dante Discovery Process Control Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
Unknown
Unknown
Unknown
US
Software Vulnerability
45
06/02/2025
-
-
Unknown Threat Actor(s)
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2020-29574 CyberoamOS (CROS) SQL Injection Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
Unknown
Unknown
Unknown
US
Security Appliance Vulnerability
46
06/02/2025
-
-
Unknown Threat Actor(s)
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2020-15069 Sophos XG Firewall Buffer Overflow Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
Unknown
Unknown
Unknown
US
Security Appliance Vulnerability
47
06/02/2025
Since at least December 2024
During December 2024
?
Multiple Organizations
Microsoft warns that attackers are deploying malware in ViewState code injection attacks using static ASP. NET machine keys found online.
Malware
Multiple Industries
Unknown
Unknown
Misconfiguration
48
06/02/2025
-
-
PlushDaemon
Multiple Organizations
Researchers at Sucuri observe threat actors leveraging Google Tag Manager (GTM) to deliver credit card skimmer malware targeting Magento-based e-commerce websites.
Malicious Script Injection
Wholesale and retail
Cyber Crime
>1
Misconfiguration
49
06/02/2025
Since 20/12/2024
20/12/2024
?
Multiple Organization
Researchers at Checkpoint discover a new phishing campaign targeting over 12,000 email addresses across hundreds of businesses, with fake Facebook copyright notices.
Account Takeover
Multiple Industries
Cyber Crime
AU
US
EU
Phishing Email
50
06/02/2025
-
-
?
Multiple Organizations
Researchers at ReversingLabs uncover two malicious machine learning (ML) models on Hugging Face that leveraged an unusual technique of "broken" pickle files to evade detection.
Malware
Multiple Industries
Cyber Crime
>1
Supply Chain Compromise
51
06/02/2025
'Recently'
'Recently'
?
Undisclosed Organization in South Korea
Researchers at AhnLab discover a case in which cryptocurrency-mining malware was being distributed via USB in South Korea.
Malware
Unknown
Cyber Crime
KR
USB Drive
52
06/02/2025
-
-
?
Undisclosed Organization(s)
Researchers at Field Effect observe threat actors exploiting CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728, three recently disclosed security flaws in SimpleHelp's Remote Monitoring and Management (RMM) software as a precursor for what appears to be a ransomware attack.
Ransomware
Unknown
Cyber Crime
Unknown
Software Vulnerability
53
06/02/2025
-
-
?
IMI
British-based engineering firm IMI plc discloses a security breach after unknown threat actors hack into the company's systems.
Unknown
Professional, scientific and technical
Cyber Crime
GB
Unknown
54
06/02/2025
Since at least 04/02/2025
04/02/2025
Multiple Threat Actors
Multiple Organizations
Researchers discover dozens of fake DeepSeek websites used for credential phishing, cryptocurrency theft, and scams.
Account Takeover
Multiple Industries
Cyber Crime
>1
Rogue Website
55
06/02/2025
During June 2024
06/02/2025
“Valerie”
Ya-moon
A threat actor using the alias “Valerie” claims to have hacked Ya-moon, a notorious South Korean adult website and forum. According to the threat actor, the hack took place in June 2024 using a zero-day vulnerability.
Unknown
Other service activities
Cyber Crime
KR
Public-facing App Vulnerability
56
06/02/2025
-
-
?
21 Taliban Ministries and Government Agencies
A group of unidentified threat actors breaches the Taliban’s databases, leaking documents from 21 ministries and government agencies, some of which appear to be classified.
Unknown
Public admin and defence, social security
Hacktivism
AF
Unknown
57
07/02/2025
Since January 2025
Since January 2025
?
Multiple Organizations
Researchers at the Shadowserver Foundation discover a large-scale brute force password attack using almost 2.8 million IP addresses and attempting to guess the credentials for a wide range of networking devices, including those from Palo Alto Networks, Ivanti, and SonicWall.
Brute-Force
Multiple Industries
Cyber Crime
AR
BR
RU
TR
MA
MX
N/A
58
07/02/2025
-
-
?
Multiple Organizations
Researchers at Trimble warn that threat actors are exploiting CVE-2025-0994, a Cityworks deserialization vulnerability to remotely execute commands on IIS servers and deploy Cobalt Strike beacons for initial network access.
Malware
Multiple Industries
Cyber Crime
>1
Software Vulnerability
59
07/02/2025
During 2024
During 2024
Chinese-speaking threat actors
Government, Universities, Technology, and Telecommunication Organizations in India, Thailand, Vietnam, Philippines, Singapore, Taiwan, South Korea, Japan, and Brazil
Researchers at Trend Micro discover DragonRank, a campaign carried out by Chinese-speaking threat actors targeting Internet Information Services (IIS) servers in Asia as part of a search engine optimization (SEO) manipulation campaign designed to install BadIIS malware.
Malware
Multiple Industries
Cyber Crime
BR
IN
JP
KR
PH
SG
TH
TW
VN
Misconfiguration
60
07/02/2025
-
-
?
Customers of a Leading Indian Bank
Researchers at Cyfirma unveil a sophisticated malware campaign dubbed “FinStealer”, actively targeting customers of a leading Indian bank through fraudulent mobile applications.
Malware
Fintech
Cyber Crime
IN
Rogue App
61
07/02/2025
03/02/2025
03/02/2025
?
Lee Enterprises
Lee Enterprises, one of the largest newspaper groups in the United States, says a cyberattack that hit its systems caused an outage and impacted its operations.
Ransomware
Information and communication
Cyber Crime
US
Unknown
62
07/02/2025
02/02/2025
03/02/2025
?
University of The Bahamas
A ransomware gang shuts down the internet and telephone systems used by the University of The Bahamas, forcing changes on administrators, professors and students.
Ransomware
Education
Cyber Crime
BS
Unknown
63
07/02/2025
26/11/2024
26/11/2024
?
University Diagnostic Medical Imaging (UDMI)
University Diagnostic Medical Imaging (UDMI), a medical imaging center in New York, says threat actors accessed certain information on its systems for a brief period on November 26, before the suspicious activity was discovered. 138,080 individuals are impacted by the data breach.
Unknown
Human health and social work
Cyber Crime
US
Unknown
64
07/02/2025
01/11/2024
02/11/2024
Embargo
Memorial Hospital and Manor
Memorial Hospital and Manor informs approximately 120,000 individuals that their sensitive information was compromised in a ransomware attack that occurred in November 2024.
Ransomware
Human health and social work
Cyber Crime
US
Unknown
65
07/02/2025
26/06/2024
28/06/2024
?
Humboldt Independent Practice Association
Humboldt Independent Practice Association discloses a phishing incident with an unauthorized actor gaining access to a single email account.
Account Takeover
Human health and social work
Cyber Crime
US
Unknown
66
10/02/2025
-
-
Unknown Threat Actors
Unknown Organization(s)
Apple releases out-of-band security updates to address CVE-2025-24200, a security flaw in iOS and iPadOS that it said has been exploited in the wild.
Unknown
Unknown
Unknown
Unknown
OS Vulnerability
67
10/02/2025
Between November 2024 and January 2025
Between November 2024 and January 2025
Lazarus Group
Crypto Developers
Researchers at SecurityScorecard reveal the details of operation Marstech Mayhem, carried out by the North Korean threat actor Lazarus Group via a previously undocumented JavaScript implant named Marstech1 as part of limited targeted attacks against developers.
Targeted Attack
Fintech
Cyber Crime
>1
Supply Chain Compromise
68
10/02/2025
09/02/2025
09/02/2025
RansomHub
Sault Ste. Marie Tribe of Chippewa Indians
A ransomware attack on the Sault Tribe in Michigan knocks many of its most critical services offline. The threat actor claims to have stolen have acquired 119 GB of data (501,211 files).
Ransomware
Public admin and defence, social security
Cyber Crime
US
Unknown
69
10/02/2025
-
09/02/2025
Handala
Israeli police
The Iranian-linked threat actor Handala claims to have breached the Israeli police systems, stealing 2.1TB of sensitive data. Police deny the breach.
Unknown
Public admin and defence, social security
Hacktivism
IL
Unknown
70
11/02/2025
-
-
Unknown Threat Actors
Unknown Organization(s)
Fortinet warns that threat actors are exploiting a new zero-day vulnerability, tracked as CVE-2025-55591, in FortiOS and FortiProxy to hijack Fortinet firewalls.
Unknown
Unknown
Unknown
Unknown
Security Appliance Vulnerability
71
11/02/2025
-
-
Unknown Threat Actors
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds the CVE-2024-40890 Zyxel DSL CPE OS Command Injection Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
IOT Vulnerability
72
11/02/2025
-
-
Unknown Threat Actors
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds the CVE-2024-40891 Zyxel DSL CPE OS Command Injection Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
IOT Vulnerability
73
11/02/2025
-
-
Unknown Threat Actors
Unknown Organization(s)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds the CVE-2025-21418 Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
OS Vulnerability
74
11/02/2025
-
-
Unknown Threat Actors
Unknown Organization(s)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds the CVE-2025-21391 Microsoft Windows Storage Link Following Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
Unknown
Unknown
Unknown
US
OS Vulnerability
75
11/02/2025
Since January 2025
Since January 2025
Kimsuky (aka Emerald Sleet or Velvet Chollima
Individuals that work in international affairs organizations, NGOs, government agencies, and media companies across North America, South America, Europe, and East Asia.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds the CVE-2025-21391 Microsoft Windows Storage Link Following Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
Malware
Individual
Cyber Espionage
>1
Social Engineering
76
11/02/2025
Since the beginning of February 2025
Since the beginning of February 2025
?
Multiple Organizations
Researchers at GreyNoise identify a significant spike in exploitation activity targeting two vulnerabilities, CVE-2022-47945 (ThinkPHP LFI) and CVE-2023-49103 (ownCloud GraphAPI Information Disclosure).
Unknown
Multiple Industries
Unknown
>1
Public-facing App Vulnerability
77
11/02/2025
Since Late 2023
During January 2025
Sandworm (a.k.a. UAC-0113, APT44, and Seashell Blizzard)
Ukrainian Windows users
Researchers at EcleticIQ reveal that the Sandworm Russian military cyber-espionage group is targeting Windows users in Ukraine with trojanized Microsoft Key Management Service (KMS) activators and fake Windows updates.
Targeted Attack
Individual
Cyber Espionage
UA
Rogue App
78
11/02/2025
11/02/2025
11/02/2025
?
zkLend
Decentralized money lender zkLend suffers a breach where threat actors exploited a smart contract flaw to steal 3,600 Ethereum, worth $9.5 million at the time.
Unknown
Fintech
Cyber Crime
N/A
Software Vulnerability
79
11/02/2025
Since early January 2025
Early January 2025
?
Multiple Organizations
Researchers at eSentire observe an increase in the number of incidents involving the NetSupport Remote Access Trojan (RAT) in attacks that involve the emerging "ClickFix” Initial Access Vector (IAV), where end-users are socially engineered into copying and executing attacker-provided PowerShell commands.
Malware
Multiple Industries
Cyber Crime
>1
Social Engineering
80
11/02/2025
-
-
Threat actors from China
Suppliers of manufacturers in “sensitive” domains
Researchers at Check Point reveal the details of a new Chinese cyber campaign targeting suppliers of manufacturers in “sensitive” domains in the US and across the globe.
Targeted Attack
Manufacturing
Cyber Espionage
>1
IoT Vulnerability
81
11/02/2025
-
09/02/2025
“Gloomer”
OmniGPT
A threat actor with the alias "Gloomer° claims to have breached OmniGPT, an AI-powered chatbot and productivity platform, exposing 30,000 user emails, phone numbers, and more than 34 million (34,270,455) lines of user conversations.
Unknown
Professional, scientific and technical
Cyber Crime
US
Unknown
82
11/02/2025
-
-
APT40
Multiple Organizations in the Pacific Region
Samoa's Computer Emergency Response Team, or SamCERT, warns that APT40 is deploying fileless malware and modified commodity malware to infiltrate and persist within networks while evading detection.
Targeted Attack
Multiple Industries
Cyber Espionage
>1
Unknown
83
12/02/2025
'Recently'
'Recently'
?
Multiple Organizations
Researchers at Sucuri discover a credit card stealing malware campaign targeting e-commerce sites running Magento by disguising the malicious content within image tags in HTML code in order to stay under the radar.
Malicious Script Injection
Wholesale and retail
Cyber Crime
>1
Public-facing App Vulnerability
84
12/02/2025
During Late 2024
During Late 2024
?
Multiple Organizations
Researchers at Sekoia discover a campaign carried out via a newly discovered malware, dubbed “Ratatouille” (or I2PRAT), bypassing User Account Control (UAC) and leveraging the Invisible Internet Project (I2P) network for anonymous Command and Control (C2) communications.
Malware
Multiple Industries
Cyber Crime
>1
Rogue Website
85
12/02/2025
Since at least 31/01/2025
31/01/2025
?
Individuals in Turkey
Researchers at Cyble discover BTMOB RAT, a new Android malware spreading via phishing sites.
Malware
Individual
Cyber Crime
TR
Rogue Website
86
12/02/2025
Since at least 2021
Since at least 2021
APT44, a.k.a. 'Seashell Blizzard' and 'Sandworm'
Critical Organizations and Governments Worldwide
Researchers at Microsoft disclose a multi-year campaign, dubbed 'BadPilot, carried out by a subgroup of the Russian state-sponsored hacking group APT44, also known as 'Seashell Blizzard' and 'Sandworm', targeting critical organizations and governments.
Targeted Attack
Multiple Industries
Cyber Espionage
>1
>1
87
12/02/2025
Since H2 2024
Since H2 2024
?
Multiple Organizations
Researchers at Netskope unveil a widespread phishing campaign, leveraging bogus PDF documents hosted on the Webflow content delivery network (CDN) with an aim to steal credit card information and commit financial fraud.
Account Takeover
Individual
Cyber Crime
>1
Malvertising
88
12/02/2025
Between 06/02/2025 and 12/02/2025
12/02/2025
?
Steam Players
A free-to-play game named PirateFi in the Steam store has been distributing the Vidar infostealing malware to unsuspecting users.
Malware
Arts entertainment, recreation
Cyber Crime
>1
Rogue App
89
12/02/2025
-
-
?
Unknown Organization(s)
Palo Alto Networks customers are advised to patch their products, after it emerged that threat actors are actively exploiting the CVE-2025-0108 vulnerability, chained with CVE-2024-9474 and CVE-2025-0111.
Unknown
Unknown
Unknown
Unknown
Security Appliance Vulnerability
90
12/02/2025
-
-
?
Unknown Organization(s)
SonicWall customers are advised to patch their products, after it emerged that threat actors are actively exploiting the CVE-2024-53704 vulnerability.
Unknown
Unknown
Unknown
Unknown
Security Appliance Vulnerability
91
12/02/2025
30/01/2025
01/02/2025
Sarcoma
Unimicron
A relatively new ransomware operation named ‘Sarcoma’ claims responsibility for an attack against the Unimicron printed circuit boards (PCB) maker in Taiwan.
Ransomware
Manufacturing
Cyber Crime
TW
Unknown
92
12/02/2025
-
-
?
Virginia Attorney General’s Office
The Virginia Attorney General’s Office is struck by a cyberattack that forces officials off the office’s computer systems.
Unknown
Public admin and defence, social security
Cyber Crime
US
Unknown
93
12/02/2025
-
-
Unknown Threat Actor(s)
Unknown Organization(s) in the U.S.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2025-24200 Apple iOS and iPadOS Incorrect Authorization Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
Unknown
Unknown
Unknown
US
IoT Vulnerability
94
13/02/2025
During January 2025
During January 2025
?
Multiple Organizations
Researchers at Rapid7 reveal that the threat actors who were behind the exploitation of a zero-day vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products in December 2024 likely also exploited CVE-2025-1094, a previously unknown SQL injection flaw in PostgreSQL.
Unknown
Multiple Industries
Cyber Crime
>1
Software Vulnerability
95
13/02/2025
Since at least March 2023
Since at least March 2023
REF7707 a.k.a. CL-STA-0049
Governments, Defense, Telecommunication, Education and Aviation sectors in Southeast Asia and South America
Researchers from Elastic and Palo Alto Networks disclose the details of a new campaign from Chinese-speaking threat actors, targeting governments, defense, telecommunication,education and aviation sectors in Southeast Asia and South America with a malware strain called FINALDRAFT capable of granting remote access to infected hosts.
Targeted Attack
Multiple Industries
Cyber Espionage
>1
Unknown
96
13/02/2025
November 2024
November 2024
Emperor Dragonfly
Asian Software and Services Company
Researchers from Symantec reveal that a China-based threat actor, tracked as Emperor Dragonfly and commonly associated with cybercriminal endeavors, has been observed using Korplug, a toolset previously attributed to espionage actors, in a RA World ransomware attack.
Ransomware
Professional, scientific and technical
Cyber Crime
Unknown
Supply Chain Compromise
97
13/02/2025
-
-
Kimsuky, a.k.a. APT43, Black Banshee, Emerald Sleet, Sparkling Pisces, Springtail, TA427, and Velvet Chollima.
South Korean Business, Government, and Cryptocurrency Sectors
Researcher at Securonix unveil the details of DEEP#DRIVE, a campaign by the North Korean threat actor Kimsuky targeting South Korean business, government, and cryptocurrency sectors.
Targeted Attack
Multiple Industries
Cyber Crime
KR
Phishing Email
98
13/02/2025
Between December 2024 and January 2025.
Between December 2024 and January 2025.
Salt Typhoon a.k.a. RedMike
Five Telecommunications Firms in the U.S.
Researchers at Recorded Future reveal that the Chinese government-linked hacking group, Salt Typhoon, is continuing to compromise telecommunications providers in the U.S. exploiting two vulnerabilities (tracked as CVE-2023-20198 and CVE-2023-20273) to compromise unpatched Cisco devices running Cisco IOS XE software.
Targeted Attack
Information and communication
Cyber Espionage
US
OS Vulnerability
99
13/02/2025
Since August 2024
Since August 2024
Storm-2372
Government, non-Governmental Organizations (NGOs), Information Technology (IT) Services and Technology, Defense, Telecommunications, Health, Higher Education, and Energy/Oil and Gas sectors in Europe, North America, Africa, and the Middle East.
Researchers at Microsoft unveil an emerging threat cluster of Russian origin, dubbed Storm-2372 attributed to a new set of cyber attacks aimed at a variety of sectors since August 2024, using the 'device code phishing' technique.
Targeted Attack
Multiple Industries
Cyber Espionage
>1
OS Vulnerability
100
13/02/2025
Since Mid-January 2025
Since Mid-January 2025
Threat Actors from Russia
Multiple Organizations
Researchers from Volexity identify several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts, using the 'device code phishing' technique.
Account Takeover
Multiple Industries
Cyber Espionage
UA
US
Other Countries
Instant Messaging App
Phishing Email
101
13/02/2025
-
-
Mustang Panda
Undisclosed Organization(s)
Researchers at ClearSky reveal to have discovered a UI vulnerability in Microsoft Windows, actively exploited by a suspected Chinese APT group - Mustang Panda.
Unknown
Unknown
Cyber Espionage
Unknown
N/A
102
13/02/2025
Between October and November 2024.
Between October and November 2024.
PurpleBravo (threat actor from North Korea a.k.a. CL-STA-0240, Famous Chollima, and Tenacious Pungsan)
At least seven entities, three of which are in the cryptocurrency sector, including a market-making firm, an online casino, and a software company.
Researchers at Recorded Future discover a new wave of attacks from the Contagious Interview campaign targeting at least seven entities, three of which are in the cryptocurrency sector, including a market-making firm, an online casino, and a software company.
Targeted Attack
Multiple Industries
Cyber Espionage
Cyber Crime
>1
Social Engineering
103
13/02/2025
Since at least January 2025
During January 2025
EarthKapre, a.k.a. RedCurl
Private-sector Organizations, especially in the Law Firms & Legal Services Industry
Researchers at eSentire unveil a new campaign from the group EarthKapre, also referred to as RedCurl, targeting private-sector organizations, particularly those in the Law Firms & Legal Services industry, using a legitimate Adobe executable (ADNotificationManager.exe) to sideload the EarthKapre/RedCurl loader.
Targeted Attack
Professional, scientific and technical
Cyber Espionage
>1
Phishing Email
104
13/02/2025
Since at least March 2024
During March 2024
Winnti, overlapping with Earth Freybug, a subset of APT41, a.k.a. CuckooBees, and Blackfly.
Japanese Companies in the Manufacturing, Materials, and Energy Sectors
Researchers at LAC attribute the China-linked threat actor known as Winnti to a new campaign dubbed RevivalStone that targeted Japanese companies in the manufacturing, materials, and energy sectors in March 2024.
Targeted Attack
Multiple Industries
Cyber Espionage
JP
Public-facing App Vulnerability
105
13/02/2025
-
24/01/2025
Jurak
Zacks Investment Research (Zacks)
A threat actor named Jurak publishes data samples on a hacker forum, claiming a breach at Zacks Investment Research in June 2024 that exposed data of 12 millions of customers.
Account Takeover
Public admin and defence, social security
Cyber Crime
US
Unknown
106
13/02/2025
'Recently'
'Recently'
?
Multiple Organizations
Researchers at Cyfirma discover a campaign distributing stealer malware via obfuscated JavaScript files to harvest a wide range of sensitive data from compromised Windows systems and exfiltrate it to a Telegram bot.
Malware
Multiple Industries
Cyber Crime
>1
Rogue Website
107
13/02/2025
Since Q3-Q4 2024
Since Q3-Q4 2024
Multiple Threat Actors
Multiple Organizations in the UAV and counter-UAV sector
Researchers at Resecurity detect a rise in cyberattacks targeting UAV and counter-UAV technologies.
>1
Manufacturing
Cyber Espionage
>1
Unknown
108
13/02/2025
-
-
?
Unknown Organizations/Individuals
Italian spyware maker SIO, known to sell its products to government customers, is behind Spyrtacus, a spyware embedded in a series of malicious Android apps that masquerade as WhatsApp and other popular apps but steal private data from a target’s device.
Malware
Unknown
Cyber Espionage
Unknown
Unknown
109
13/02/2025
-
-
"Tooda"
Doxbin
A threat actor with the moniker "Tooda" leaks 136,000+ user records, emails, and a ‘blacklist’ file, exposing those who paid to keep their info off the doxxing platform.
Unknown
Unknown
Cyber Crime
N/A
Unknown
110
14/02/2025
'Recently'
'Recently'
?
Undisclosed Organization
Researchers at Sucuri discover an incident involving a WordPress site that leveraged the mu-plugins (or must-use plugins) directory to implant backdoors and execute malicious PHP code in a stealthy manner.
Malware
Unknown
Cyber Crime
Unknown
Misconfiguration
111
14/02/2025
Since at least 04/02/2025
04/02/2025
?
Multiple Organizations
Researchers at Cofense discover a phishing campaign leveraging a fake 'Adobe Drive X' app to steal Microsoft Login credentials.
Account Takeover
Multiple Industries
Cyber Crime
>1
Phishing Email
112
14/02/2025
-
-
?
Individuals in India
Researchers at CloudSEK discover a large-scale Search Engine Poisoning (SEP) campaign that targets Indian government, educational, and financial websites.
Malware
Individual
Cyber Crime
IN
SEO Poisoning
113
14/02/2025
Since at least 04/02/2025
04/02/2025
Threat Actors from Russia
Multiple Organizations
Researchers at Netskope shed light on a new Golang-based backdoor that uses Telegram as a mechanism for command-and-control (C2) communications.
Malware
Multiple Industries
Cyber Crime
>1
Unknown
114
14/02/2025
During June 2023
During June 2023
“Nam3l3ess"
PPL Electric Utilities
PPL Electric Utilities, a Pennsylvania utility company says that basic customer data stolen from one of its vendors in 2023, via the MOVEit file transfer software vulnerability, was recently exposed online, but the incident did not affect its core systems.
Unknown
Electricity, gas steam, air conditioning
Cyber Crime
US
Software Vulnerability
115
14/02/2025
Early February 2025
Early February 2025
?
Individuals the U.S.
Cybersecurity researchers at Veriti discovere a campaign targeting the release of declassified JFK (John F. Kennedy), RFK (Robert F. Kennedy Jr.), and MLK (Martin Luther King Jr.) files.
October 2026 Cyber Attacks Timeline
Mega Breaches in 2026
September 2026 Cyber Attacks Timeline
H1 2024 Cyber Attacks Statistics
August 2026 Cyber Attacks Statistics Infographic