Incidents

Cyber security incidents, campaigns and responsibly disclosed issues

Name	Pub. date	Actors	Initial access	Impact	Type	Status
perfctl Malware Targeting Linux	October 3, 2024	❓Unknown	1-day vulnerability	Resource hijacking	Campaign	Finalized
REF6138 campaign	September 27, 2024	🎰REF6138	Unknown	Resource hijacking	Campaign	Finalized
Storm-0501 Targeting Hybrid Environments with Ransomware	September 26, 2024	Storm-0501	1-day vulnerability	RansomOp	Campaign	Finalized
Docker Swarm and K8s cryptojacking campaign	September 23, 2024	❓Unknown	Software misconfig	Resource hijacking	Campaign	Stub
UNC1860 Attacks Targeting the Middle East	September 20, 2024	💡UNC1860	1-day vulnerability	Data exfiltration	Campaign	Finalized
Scattered Spider targeting GCP environment	September 17, 2024	🐙0ktapus	Unknown	RansomOp	Incident	Stub
Scattered Spider targeting Azure environment	September 17, 2024	🐙0ktapus	End-user compromise	RansomOp	Incident	Stub
GitHub PAT leakage leading to RDS Database exfiltration	September 17, 2024	❓Unknown	Exposed secret	Data exfiltration	Incident	Stub
Fortinet Sharepoint data leak	September 12, 2024	❓Unknown	Unknown	Data exfiltration	Incident	Stub
Campaign targeting Selenium Grid for cryptomining	September 12, 2024	❓Unknown	Software misconfig	Resource hijacking	Campaign	Finalized
Hadooken Malware Targeting Weblogic Servers	September 12, 2024	❓Unknown	Software misconfig	Resource hijacking	Campaign	Finalized
DragonRank Targeting IIS Web Servers	September 10, 2024	🐲DragonRank	1-day vulnerabilitySoftware misconfig	Data exfiltrationResource hijacking	Campaign	Finalized
Godzilla Backdoor Exploiting Confluence Vulnerability	August 30, 2024	❓Unknown	1-day vulnerability	Unknown	Campaign	Finalized
Confluence exploited for cryptojacking	August 28, 2024	❓Unknown	1-day vulnerability	Resource hijacking	Campaign	Finalized
ShinyHunters Ransomware Targeting Cloud Environments	August 23, 2024	🪙Bling Libra	Exposed secretCloud native misconfig	RansomOp	Campaign	Finalized
Scattered Spider abuses Cloud Management Agent to establish persistence	August 20, 2024	🐙0ktapus			Incident	Stub
PG_MEM Malware Exploiting Misconfigured PostreSQL Instances	August 19, 2024	❓Unknown	Software misconfigPassword attack	Resource hijacking	Campaign	Finalized
Msupedge Backdoor Targeting Taiwanese University	August 19, 2024	❓Unknown	1-day vulnerability	Data exfiltration	Campaign	Finalized
Extortion Campaign Exploiting Exposed Environment Variable	August 15, 2024	❓Unknown	Exposed secret	Data exfiltrationRansomOp	Campaign	Finalized
Gafgyt Malware Targeting Cloud Environments	August 14, 2024	Gafgyt operator	Password attack	Resource hijacking	Campaign	Finalized
Horde Panda targeting South Asian telecommunications provider	August 9, 2024	Horde Panda	Functionality abuse	Data exfiltration	Campaign	Finalized
Scattered Spider Abuses Cloud Management Agent	August 9, 2024	🐙0ktapus	End-user compromise	Resource hijacking	Campaign	Finalized
Earth Baku campaign	August 9, 2024	🦠APT41	Software misconfig	Data exfiltration	Campaign	Finalized
Panamorfi campaign	August 2, 2024	❓Unknown	Software misconfig	Denial of service	Campaign	Stub
Mirai Botnet Exploiting Apache OFBiz Vulnerability	July 31, 2024	🪞Mirai	1-day vulnerability	Resource hijacking	Campaign	Finalized
Ransomware operators exploit ESXi vulnerability	July 29, 2024	🌩️Storm-0506 🌩️Storm-1175 🦭Manatee Tempest 🐙0ktapus	1-day vulnerability	RansomOp	Campaign	Finalized
BORN Group supply chain attack	July 25, 2024	🕵️IntelBroker	1-day vulnerability	Supply chain attack	Incident	Stub
SeleniumGreed: Threat actors exploit exposed Selenium Grid services for Cryptomining	July 25, 2024	❓Unknown	Functionality abuseSoftware misconfig	Resource hijacking	Campaign	Finalized
CRYSTALRAY: threat actors exploiting OSS tools	July 11, 2024	💠CRYSTALRAY	1-day vulnerability	Resource hijackingData exfiltration	Campaign	Finalized
Python infrastructure leaked access token	July 8, 2024		Exposed secret	Resp. disclosure	Research	Stub
Misconfigured Jenkins Servers Used for Cryptomining	July 5, 2024	❓Unknown	Unknown	Resource hijacking	Campaign	Stub
8220 Gang Exploiting WebLogic Vulnerabilities for Cryptojacking	June 30, 2024	8️⃣8220 Gang	1-day vulnerability	Resource hijacking	Campaign	Finalized
Funnull Polyfill supply chain attack	June 25, 2024	🏓Funnull	Insider threatSupply chain vector	Supply chain attackDefacement	Campaign	Finalized
Rabbit AI exposed keys in code	June 25, 2024		Exposed secret	Resp. disclosure	Research	Stub
RedJuliett Exploiting VPN and Firewall Vulnerabilities	June 24, 2024	💃RedJuliett	Software misconfig1-day vulnerabilityWeb vulnerability	Data exfiltration	Campaign	Finalized
Boolka campaign	June 21, 2024	Boolka	Web vulnerability	Resource hijacking	Campaign	Stub
Scattered Spider SaaS targeting (2024)	June 14, 2024	🐙0ktapus	End-user compromise	Data exfiltrationRansomOp	Campaign	Finalized
NCS mass server deletion	June 13, 2024		Insider threat	Data destruction	Incident	Stub
RCE Vulnerability in PHP CGI Exploited by TellYouThePass	June 10, 2024	🎫TellYouThePass Gang	1-day vulnerability	RansomOp	Campaign	Stub
NYT source code theft	June 8, 2024	❓Unknown	End-user compromise	Data exfiltration	Incident	Stub
DERO cryptojacking campaign (2024)	June 7, 2024	❓Unknown	Cloud native misconfig	Resource hijacking	Campaign	Finalized
Scylla LLMJacking campaign	June 6, 2024	❓Unknown	End-user compromise	Resource hijacking	Campaign	Stub
Gitloker campaign	June 5, 2024	Gitloker	End-user compromise	RansomOp	Campaign	Stub
Club Penguin data theft via Confluence	June 5, 2024	❓Unknown	End-user compromise	Data exfiltration	Incident	Stub
Dama webshell deployment via ThinkPHP exploitation	June 5, 2024	❓Unknown	1-day vulnerability	Resource hijacking	Campaign	Stub
Operation Veles	June 4, 2024	UTG-Q-008	Password attack	Resource hijacking	Campaign	Stub
Muhstik campaign	June 4, 2024	🍥Muhstik operator	1-day vulnerability	Resource hijackingDenial of service	Campaign	Finalized
ByteDance Rspack GitHub misconfiguration	May 31, 2024		Software misconfig	Resp. disclosure	Research	Stub
RedTail Cryptomining campaign	May 30, 2024	🍒RedTail operator	1-day vulnerability	Resource hijacking	Campaign	Finalized
Snowflake compromised creds abuse campaign	May 29, 2024	💡UNC5537	End-user compromise	Data exfiltration	Incident	Stub
Kinsing targeting cloud servers	May 16, 2024	👑Kinsing operator	1-day vulnerability	Resource hijacking	Campaign	Finalized
Mirai campaign targeting Ivanti products	May 7, 2024	❓Unknown	1-day vulnerability	Resource hijacking	Campaign	Stub
Atlas Lion phishing campaign	May 6, 2024	🦁Atlas Lion	End-user compromise	Resource hijackingDenial of walletData exfiltration	Campaign	Finalized
LLMjacking via Laravel exploitation	May 6, 2024	❓Unknown	1-day vulnerability	Resource hijacking	Incident	Finalized
Utah “Bathroom Bill” open database	May 3, 2024		Cloud native misconfig	Data exfiltration	Research	Stub
TargetCompany Abusing MSSQL Servers for Ransomware	May 2, 2024	🏣TargetCompany	Password attackSoftware misconfig	RansomOp	Campaign	Finalized
ArcaneDoor Campaign Targeting Cisco Adaptive Security Appliance 0day	April 24, 2024	🌩️STORM-1849	0-day vulnerability	Data exfiltration	Campaign	Finalized
APT28 Targeting Print Spooler Vulnerability for GooseEgg Deployment	April 22, 2024	🧸APT28	0-day vulnerability1-day vulnerability	Data exfiltration		Finalized
MITRE breach via Ivanti Connect Secure	April 19, 2024	💡UNC5221	1-day vulnerability	Data exfiltration	Incident	Stub
K8s targeted via OpenMetadata exploitation	April 17, 2024	❓Unknown	1-day vulnerabilityExposed secret	Resource hijacking	Campaign	Finalized
Delinea breach	April 14, 2024	❓Unknown	1-day vulnerability	Unknown	Incident	Stub
Abusing management tooling for cloud access	April 11, 2024	❓Unknown	End-user compromise	Data exfiltration	Incident	Stub
Sisense breach	April 11, 2024	❓Unknown	Unknown	Data exfiltration	Incident	Finalized
From password reset to data exfiltration	April 11, 2024	❓Unknown	Cloud native misconfig	Data exfiltration	Incident	Stub
Smishing into Entra onto VMWare ransomware	April 11, 2024	❓Unknown	End-user compromise	RansomOp	Incident	Stub
Third party to cloud compromise	April 11, 2024	❓Unknown	Supply chain vector	RansomOp	Incident	Stub
Personal local drive to AWS ransomware	April 11, 2024	❓Unknown	End-user compromise	RansomOp	Incident	Stub
RUBYCARP: Botnet Exploiting Vulnerabilities for Crypto	April 9, 2024	🎏RUBYCARP	1-day vulnerabilityPassword attack	Denial of serviceResource hijacking	Campaign	Finalized
Microsoft exposed storage with credentials	April 9, 2024		Cloud native misconfig	Resp. disclosure	Research	Stub
Muddled Libra campaigns (2024)	April 9, 2024	🐙0ktapus	End-user compromise	Data exfiltration	Campaign	Stub
Hugging Face cross-tenant access	April 4, 2024		Cloud native misconfigWeb vulnerability	Resp. disclosure	Research	Finalized
Affirmed Networks breach	April 2, 2024	🌩️Storm-0558	Unknown	Data exfiltration	Incident	Finalized
XZ Utils backdoor incident	March 29, 2024	❓Unknown	Insider threat	Supply chain attack	Incident	Finalized
Agenda Ransomware Targets ESXi and vCenter Servers	March 26, 2024	📓Agenda operator	Unknown	RansomOp	Campaign	Finalized
Compromise of Top.gg repo	March 25, 2024	❓Unknown	End-user compromise	Supply chain attack	Incident	Stub
UNC5174 ScreenConnect and F5 BIG-IP exploitation	March 22, 2024	💡UNC5174	1-day vulnerability	Data exfiltration	Campaign	Finalized
Fujitsu exposed bucket	March 21, 2024		Cloud native misconfig	Resp. disclosure	Research	Stub
Widespread TeamCity exploitation (March ‘24)	March 19, 2024	❓Unknown	1-day vulnerability	Resource hijackingRansomOp	Campaign	Stub
ShadowSyndicate aiohttp exploitation	March 15, 2024	🌒ShadowSyndicate	1-day vulnerability	RansomOp	Campaign	Finalized
Meson Network cryptojacking campaign	March 11, 2024	❓Unknown	1-day vulnerabilitySoftware misconfig	Resource hijacking	Campaign	Finalized
From writable bucket to credential theft	March 8, 2024		Cloud native misconfig	Resp. disclosure	Research	Stub
Magnet Goblin campaign (2024)	March 8, 2024	👺Magnet Goblin	1-day vulnerability	Unknown	Campaign	Stub
Redis, Hadoop, and Docker exploitation	March 6, 2024	❓Unknown	Software misconfig1-day vulnerability	Resource hijacking	Campaign	Finalized
z0Miner targeting WebLogic servers	March 6, 2024	0️⃣z0miner	1-day vulnerability	Resource hijacking	Campaign	Finalized
From social engineering to cryptocurrency theft	March 6, 2024	❓Unknown	End-user compromise	Data exfiltration	Incident	Stub
From refresh token theft to global admin	February 23, 2024		Unknown	Resp. disclosure	Research	Stub
Lucifer Botnet targeting Hadoop	February 22, 2024	😈Lucifer operator	1-day vulnerabilitySoftware misconfig	Denial of serviceResource hijacking	Campaign	Finalized
US DOI PII exfiltration pentest	February 21, 2024		Insider threat	Resp. disclosure	Research	Stub
S3 ransomware scam	February 21, 2024	❓Unknown	Unknown	Data exfiltrationData destruction	Incident	Stub
Migo cryptominer targeting Redis	February 20, 2024	🏁Migo operator	Software misconfig	Resource hijacking	Campaign	Finalized
SSH-Snake Confluence targeting campaign	February 20, 2024	❓Unknown	1-day vulnerability	Resource hijacking	Campaign	Stub
WinStar exposed app database	February 18, 2024		Software misconfig	Resp. disclosure	Research	Stub
Sliver deployment via Confluence vulnerability	February 15, 2024	❓Unknown	1-day vulnerability	Resource hijacking	Campaign	Stub
BMW exposed cloud storage	February 14, 2024		Cloud native misconfig	Resp. disclosure	Research	Stub
U.S. Internet exposed email server	February 14, 2024		Software misconfig	Resp. disclosure	Research	Stub
CGI Federal incident	February 13, 2024	❓Unknown	1-day vulnerability	Data exfiltration	Incident	Stub
Zenlayer exposed database	February 13, 2024		Software misconfig	Resp. disclosure	Research	Stub
Microsoft Smartscreen Vulnerability Exploited by Water Hydra	February 13, 2024	🐉Water Hydra	1-day vulnerabilityEnd-user compromise0-day vulnerability	Data exfiltration	Campaign	Finalized
Würk exposed database	February 9, 2024		Software misconfig	Resp. disclosure	Research	Stub
Juniper support portal exposure	February 9, 2024		Software misconfig	Resp. disclosure	Research	Stub
C3Pool mining via Confluence vulnerability	February 8, 2024	❓Unknown	1-day vulnerability	Resource hijacking	Campaign	Stub
Almerys incident	February 8, 2024	❓Unknown	Unknown	Data exfiltration	Incident	Stub
Viamedis incident	February 8, 2024	❓Unknown	End-user compromise	Data exfiltration	Incident	Stub
Cryptojacking via Azure Batch	February 6, 2024	❓Unknown	End-user compromise	Resource hijacking	Incident	Stub
Windows SmartScreen vulnerability exploited by Mispadu trojan	February 2, 2024	🏦Mispadu operator	1-day vulnerability	Data exfiltration	Campaign	Finalized
Cloudflare incident following Okta breach	February 1, 2024	❓Unknown	Supply chain vector	Data exfiltration	Incident	Stub
Commando Cat campaign	February 1, 2024	😼Commando Cat	Software misconfig	Resource hijacking	Campaign	Finalized
Football Australia exposed cloud key	February 1, 2024		Exposed secretCloud native misconfig	Resp. disclosure	Research	Stub
DangerDev SES abuse incident	January 31, 2024	❓Unknown	Exposed secret	Resource hijacking	Incident	Stub
New Relic incident (November 2023)	January 31, 2024	❓Unknown	End-user compromise	Data exfiltration	Incident	Stub
Mimic used by Trigona operators	January 28, 2024	📐Trigona operator	Software misconfig1-day vulnerabilityPassword attack	RansomOp	Campaign	Finalized
Mercedes-Benz source code exposure	January 26, 2024		Exposed secret	Resp. disclosure	Research	Finalized
ECS Fargate cryptojacking	January 19, 2024	❓Unknown	Exposed secret	Resource hijacking	Campaign	Finalized
S3 data exfiltration	January 19, 2024	❓Unknown	Exposed secret	Data exfiltration	Incident	Finalized
Microsoft email exfiltration by Nobelium	January 19, 2024	🐻APT29	Password attack	Data exfiltration	Incident	Finalized
From ActiveMQ to Godzilla webshell	January 18, 2024	❓Unknown	1-day vulnerability	Resource hijacking	Campaign	Stub
Mimo cryptomining campaign	January 18, 2024	📝Mimo operator	1-day vulnerability	Resource hijackingRansomOp	Campaign	Stub
9hits Docker campaign	January 18, 2024	❓Unknown	1-day vulnerability	Resource hijacking	Campaign	Stub
AndroxGh0st usage (2024)	January 16, 2024	❓Unknown	1-day vulnerabilitySoftware misconfig	Resource hijacking	Campaign	Stub
TensorFlow GitHub misconfiguration	January 15, 2024		Software misconfig	Resp. disclosure	Research	Stub
PyTorch GitHub misconfiguration	January 11, 2024		Software misconfig	Resp. disclosure	Research	Stub
FBot toolkit targets cloud environments	January 11, 2024	❓Unknown	Password attackWeb vulnerabilityFunctionality abuse	Resource hijacking	Campaign	Finalized
Dreambus campaign (2023)	January 11, 2024	🚌Dreambus operator	Software misconfig1-day vulnerability	Resource hijacking	Campaign	Stub
S3 RansomOp following long-term key exposure	January 11, 2024	❓Unknown	Exposed secret	RansomOpData exfiltration	Incident	Stub
Ivanti Connect Secure targeting campaign	January 10, 2024	💡UNC5221	0-day vulnerability	Unknown	Campaign	Stub
Apache app cryptojacking campaign	January 10, 2024	❓Unknown	1-day vulnerabilitySoftware misconfig	Resource hijacking	Campaign	Stub
RE#TURGENCE MSSQL Server RansomOp	January 10, 2024	❓Unknown	Software misconfigPassword attack	RansomOp	Campaign	Finalized
Cyber Toufan Linux destruction	December 28, 2023	🍬Cyber Toufan	Supply chain vector	Data exfiltrationData destruction	Campaign	Stub
Cloud lateral movement via Citrix cookie	December 15, 2023	❓Unknown	End-user compromise	Data exfiltration	Incident	Stub
GambleForce SQL injection campaign	December 14, 2023	🎲GambleForce	Web vulnerability1-day vulnerability	Data exfiltration	Campaign	Stub
APT29 TeamCity campaign	December 13, 2023	🐻APT29	1-day vulnerability	Data exfiltration	Campaign	Stub
OAuth applications to deploy VMs for cryptomining	December 12, 2023	🌩️Storm-1283	End-user compromise	Resource hijacking	Campaign	Stub
First Republic Bank incident	December 12, 2023	❓Unknown	Insider threat	Data destruction	Incident	Stub
Krasue Thailand campaign	December 7, 2023	👻Krasue operator	Unknown	Data exfiltration	Campaign	Stub
Package hijacking redteam op	December 6, 2023		End-user compromise	Resp. disclosure	Research	Stub
GoTitan ActiveMQ campaign	November 28, 2023	💢GoTitan operator	1-day vulnerability	Unknown	Campaign	Stub
LINE and NAVER Cloud incident	November 27, 2023	❓Unknown	End-user compromise	Data exfiltration	Incident	Stub
Andariel exploiting Apache ActiveMQ	November 27, 2023	👿Andariel	1-day vulnerability	Unknown	Campaign	Stub
Apache server Cryptojacking with Cobalt Strike	November 20, 2023	❓Unknown	1-day vulnerability	Resource hijacking	Campaign	Finalized
Confluence targeting by C3RB3R	November 14, 2023	🧸C3RB3R operator	1-day vulnerability	RansomOp	Campaign	Stub
OracleIV campaign	November 13, 2023	❓Unknown	Software misconfig	Resource hijacking	Campaign	Stub
Sumologic incident	November 7, 2023	❓Unknown	Unknown	Unknown	Incident	Stub
EleKtra-Leak	October 30, 2023	❓Unknown	Exposed secret	Resource hijacking	Campaign	Stub
Okta support system supply chain attack	October 20, 2023	❓Unknown	End-user compromise	Supply chain attack	Incident	Stub
Qubitstrike Crypto Mining and Rootkit Campaign	October 18, 2023	❓Unknown	Software misconfig	Resource hijacking	Campaign	Finalized
Cloud tools imitation campaign	October 10, 2023	❓Unknown	Supply chain vector	Unknown	Campaign	Stub
SQL Server to cloud lateral movement	October 3, 2023	❓Unknown	Web vulnerability	Data exfiltration	Campaign	Stub
Darkbeam data exposure	October 2, 2023		Software misconfig	None	Research	Stub
Prophet Spider campaign	September 20, 2023	🕷️Prophet Spider			Campaign	Stub
Scattered Spider SaaS targeting (2023)	September 20, 2023	🐙0ktapus	End-user compromise	Data exfiltrationRansomOp	Campaign	Stub
Microsoft AI data exposure	September 18, 2023		Software misconfig	Resp. disclosure	Research	Stub
AmberSquid campaign	September 18, 2023	🦑AmberSquid	Supply chain vector	Resource hijacking	Campaign	Finalized
Peach Sandstorm Azure targeting	September 14, 2023	🍑Peach Sandstorm	1-day vulnerabilityPassword attack	Data exfiltration	Campaign	Finalized
Rollbar hack	September 13, 2023	❓Unknown	End-user compromise	Data exfiltration	Incident	Stub
BlackCat Azure Storage Account RansomOp	September 13, 2023	🐈‍⬛BlackCat	Unknown	RansomOp	Incident	Stub
From SSH bruteforce to cryptojacking	September 8, 2023	❓Unknown	Password attack	Resource hijacking	Campaign	Stub
Evil_MinIO campaign	September 4, 2023	❓Unknown	1-day vulnerability	Unknown	Campaign	Stub
UNC4841 Barracuda ESG Campaign	August 29, 2023	💡UNC4841	0-day vulnerability	Data exfiltration	Campaign	Stub
Retool hack	August 29, 2023	❓Unknown	End-user compromise	Supply chain attack	Incident	Stub
Kinsing campaigns (2023-2024)	August 29, 2023	👑Kinsing operator	1-day vulnerabilitySoftware misconfig	Resource hijacking	Campaign	Stub
Fatal Model exposed database	August 25, 2023		Cloud native misconfig	Resp. disclosure	Research	Stub
Labrat GitLab campaign	August 17, 2023	🐀Labrat operator	1-day vulnerability	Resource hijacking	Campaign	Stub
From PHP exploitation to AWS lateral movement	August 15, 2023	❓Unknown	0-day vulnerability	Unknown	Incident	Stub
Scattered Spider Azure Run abuse	August 15, 2023	🐙0ktapus	Unknown	Unknown	Campaign	Stub
Use of linPEAS for cloud enumeration	August 15, 2023	❓Unknown			Incident	Stub
SugarCRM as initial access to AWS envs	August 10, 2023	❓Unknown	1-day vulnerability		Campaign	Stub
P2PInfect campaign	July 31, 2023	🦠P2PInfect	Software misconfig1-day vulnerability	Resource hijacking	Campaign	Finalized
Meow Jupyter Notebook campaign	July 31, 2023	😿Meow	Software misconfig	Data destruction	Campaign	Stub
SkidMap targeting Redis	July 30, 2023	🗺️SkidMap operator	Software misconfig	Unknown	Campaign	Stub
DepositFiles exposed config file	July 27, 2023		Software misconfig	None	Research	Stub
JumpCloud supply chain attack	July 14, 2023	💰TraderTraitor	End-user compromise	Supply chain attack	Incident	Stub
SilentBob cryptomining campaign	July 13, 2023	🔇SilentBob 💣TeamTNT	Software misconfig	Resource hijacking	Campaign	Finalized
Microsoft signing key compromise	July 11, 2023	🌩️Storm-0558	End-user compromise	Supply chain attackData exfiltration	Incident	Finalized
ScarletEel campaign (July ‘23)	July 11, 2023	🐍ScarletEel	Web vulnerabilitySoftware misconfig	Resource hijackingData exfiltrationDenial of service	Campaign	Finalized
PyLoose campaign	July 11, 2023	🧵PyLoose operator	Software misconfig	Resource hijacking	Campaign	Stub
APT31 Rekoobe campaign	July 11, 2023	⚖️APT31			Campaign	Stub
Storm-0558 phishing campaigns	July 11, 2023	🌩️Storm-0558	End-user compromise	Unknown	Campaign	Stub
RomCom exploiting Word vulnerability in campaign targeting government entities	July 3, 2023	💒RomCom	1-day vulnerabilityEnd-user compromise0-day vulnerability	RansomOpData exfiltration	Campaign	Finalized
From web app exploitation to Chisel tunneling	June 5, 2023	❓Unknown	1-day vulnerability	Unknown	Incident	Finalized
From PHP vuln to Sliver execution via cron	June 5, 2023	❓Unknown	Web vulnerability	Unknown	Incident	Finalized
Cosmic Wolf cloud activity	June 5, 2023	🐢SeaTurtle	Exposed secret	Unknown	Incident	Finalized
From WSO2 RCE to SSH lateral movement	June 5, 2023	❓Unknown	1-day vulnerability	Unknown	Incident	Stub
Poisoned image to K8s to cloud	May 25, 2023	❓Unknown	End-user compromise	None	Incident	Stub
8820 Gang targeting WebLogic	May 16, 2023	8️⃣8220 Gang	1-day vulnerability	Resource hijackingData exfiltration	Campaign	Finalized
SIM swapping to serial port abuse	May 16, 2023	🐙0ktapus	End-user compromise	Unknown	Incident	Stub
Optimeyes data leak	May 9, 2023		Software misconfig	Data exfiltration	Research	Stub
Capita data leak	May 5, 2023		Cloud native misconfig	None	Research	Finalized
fsevents supply chain attack	April 27, 2023		Dangling resource	Supply chain attack	Incident	Finalized
RBAC Buster	April 21, 2023	❓Unknown	Cloud native misconfig	Resource hijacking		Stub
8220 Gang exploiting Log4Shell	April 21, 2023	8️⃣8220 Gang	1-day vulnerability	Resource hijacking	Campaign	Stub
Misconfigured firewall to cryptojacking botnet	April 18, 2023	❓Unknown	Cloud native misconfigSoftware misconfig	Denial of walletResource hijacking	Incident	Stub
SIM-Swap to Data Leak on Dark Web	April 18, 2023	❓Unknown	End-user compromise	Data exfiltrationData destruction	Incident	Stub
Trigona targeting MSSQL servers	April 17, 2023	📐Trigona operator	Software misconfig1-day vulnerability	RansomOp	Campaign	Finalized
Mexals cryptojacking campaign	April 12, 2023	Mexals operator	Unknown	Resource hijacking	Campaign	Stub
MuddyWater cloud destruction operation	April 7, 2023	💧MuddyWater 🕶️DarkBit	Unknown	Data destructionRansomOp	Incident	Finalized
AlienFox campaign	March 30, 2023	❓Unknown	Unknown	Data exfiltration	Campaign	Stub
3CX and Trading Technologies supply chain attack	March 29, 2023	💿SmoothOperator	Unknown	Supply chain attack	Incident	Featured
ChinaZ campaigns	March 24, 2023	ChinaZ			Campaign	Stub
JavaScript injection via vulnerable CMS	March 23, 2023	❓Unknown	1-day vulnerability	Resource hijacking	Campaign	Stub
UNC3886 campaigns	March 16, 2023	💡UNC3886	1-day vulnerability	Data exfiltration	Campaign	Stub
Dero cryptojacking targeting K8s	March 15, 2023	❓Unknown	Cloud native misconfig	Resource hijacking	Campaign	Stub
GoBruteforcer campaign	March 10, 2023	🚦GoBruteforcer operator	Password attack	Resource hijacking	Campaign	Finalized
Stealing the LIGHTSHOW	March 9, 2023	💡UNC2970			Campaign	Stub
IceFire Aspera Faspex campaign	March 9, 2023	❓Unknown	1-day vulnerability	RansomOp	Campaign	Stub
ScarletEel campaign (Feb ‘23)	February 28, 2023	🐍ScarletEel	Web vulnerability	Resource hijackingData exfiltration	Campaign	Finalized
Fayvo exposed database	February 23, 2023		Software misconfig	Resp. disclosure	Research	Stub
US military email server exposure	February 18, 2023		Software misconfig	Resp. disclosure	Research	Stub
ESXiArgs ransomware campaign	February 3, 2023	❓Unknown	1-day vulnerability	RansomOp	Campaign	Stub
HeadCrab campaign	February 1, 2023	🦀HeadCrab operator	Software misconfig	Resource hijacking	Campaign	Stub
GitHub certificate theft incident	January 30, 2023	❓Unknown	End-user compromise	Data exfiltration	Incident	Stub
CommuteAir exposed Jenkins	January 19, 2023		Software misconfig	Resp. disclosure	Research	Stub
CircleCI incident	January 4, 2023	💰TraderTraitor	End-user compromise	Supply chain attack	Incident	Finalized
Jupyter Notebook cred harvesting campaign	December 28, 2022	❓Unknown	Software misconfigWeb vulnerability	Data exfiltration	Campaign	Finalized
Okta source code theft	December 21, 2022	❓Unknown	Unknown	Data exfiltration	Incident	Stub
Redigo campaign	December 1, 2022	🍎Redigo operator	1-day vulnerability	Unknown	Campaign	Stub
LastPass & GoTo incident	November 30, 2022	❓Unknown	End-user compromise	Data exfiltration	Incident	Stub
WatchDog East-Asian CSP campaign	November 16, 2022	🐶WatchDog			Campaign	Stub
Dropbox breach	November 1, 2022	❓Unknown	End-user compromise	Data exfiltration	Incident	Stub
Reuters leaky ElasticSearch DB	October 26, 2022		Software misconfig	Data exfiltration	Research	Stub
Backdoored self-hosted GitHub Runner	October 26, 2022		Software misconfig	None	Research	Stub
Leaked long-lived AWS creds	October 7, 2022	❓Unknown		None	Incident	Stub
Auth0 source code theft	September 26, 2022	❓Unknown	Unknown	Data exfiltration	Incident	Stub
Fast Company incident	September 25, 2022	❓Unknown	Software misconfig	DefacementData exfiltration	Incident	Finalized
Optus incident	September 21, 2022	❓Unknown	API vulnerability	Data exfiltration	Incident	Finalized
Kiss-A-Dog campaign	September 1, 2022	🐶WatchDog		Resource hijacking	Campaign	Finalized
Redirection Roulette	September 1, 2022	❓Unknown	Unknown	Defacement	Campaign	Finalized
APT29 targeting Microsoft 365	August 22, 2022	🐻APT29			Campaign	Stub
Microsoft credential exposure on GitHub	August 16, 2022		Exposed secret	Resp. disclosure	Research	Stub
Twilio incident	August 8, 2022	🐙0ktapus	End-user compromise	Supply chain attack	Incident	Finalized
Bondnet campaign (2022)	July 11, 2022	Bondnet	Password attack	Resource hijacking	Campaign	Stub
8220 Gang targeting Confluence	July 7, 2022	8️⃣8220 Gang	1-day vulnerability	Resource hijacking	Campaign	Stub
DarkRadiation campaign	June 21, 2022	☢️DarkRadiation operator	Unknown	RansomOp	Campaign	Stub
Spotting an attacker in GCP	June 9, 2022	❓Unknown			Incident	Stub
JavaScript injection via WordPress exploitation	May 11, 2022	❓Unknown	1-day vulnerability	Resource hijacking	Campaign	Stub
UNC2903 campaigns	May 4, 2022	💡UNC2903			Campaign	Stub
LemonDuck Docker campaign	April 21, 2022	🍋LemonDuck			Campaign	Stub
GitHub & npm incident	April 15, 2022	❓Unknown	End-user compromise	Supply chain attackData exfiltration	Incident	Finalized
Denonia campaign	April 6, 2022	❓Unknown	Unknown	Resource hijacking	Campaign	Finalized
From CLI to console, chasing an attacker in AWS	April 5, 2022	❓Unknown			Incident	Stub
Muhstick Redis campaign	March 28, 2022	🥢Muhstik			Campaign	Stub
LAPSUS$ campaigns	March 22, 2022	🫗LAPSUS$	End-user compromise	Data exfiltrationData destructionRansomOp	Campaign	Finalized
CoinStomp campaign	February 2, 2022	🪙CoinStomp operator			Campaign	Stub
From S3 bucket to Jenkins credential dump	January 13, 2022		Web vulnerabilityCloud native misconfig	Resp. disclosure	Research	Finalized
From code commit to production takeover	January 13, 2022		End-user compromise	Resp. disclosure	Research	Finalized
Ivanti supply chain attack via compromised library	December 2, 2021	❓Unknown	Supply chain vector	Supply chain attack	Incident	Stub
Tsunami targeting Jenkins and Weblogic	October 26, 2021	❓Unknown	Software misconfig1-day vulnerability	Resource hijacking	Campaign	Stub
Abcbot Huawei Cloud targeting campaign	October 8, 2021	🔤Abcbot operator	Cloud native misconfig	Resource hijacking	Campaign	Stub
Siloscape campaign	June 7, 2021	⛏️Siloscape operator	1-day vulnerabilityWeb vulnerability	Unknown	Campaign	Stub
Codecov incident	April 15, 2021	❓Unknown	Exposed secret	Supply chain attack	Incident	Featured
Gin Docker cryptojacking campaign	February 9, 2021	❓Unknown	Software misconfig	Resource hijacking	Campaign	Stub
Multiple organizations vulnerable to dependency confusion	February 9, 2021		Supply chain vector	None	Research	Stub
TeamTNT campaigns	February 3, 2021	💣TeamTNT			Campaign	Stub
Dreambus campaign (2021)	January 22, 2021	🚌Dreambus operator	1-day vulnerabilitySoftware misconfig	Resource hijacking	Campaign	Finalized
Solarigate: Solarwinds supply chain attack	December 13, 2020	🐻APT29	Unknown	Data exfiltration	Campaign	Finalized
Loggerminer campaign	November 16, 2020	🔤Abcbot operator		Resource hijacking	Campaign	Stub
Apple cloud key exposure	October 7, 2020		Web vulnerability	None	Research	Stub
Cetus campaign	August 27, 2020	❓Unknown	Software misconfig	Resource hijacking	Campaign	Stub
Doki cryptojacking campaign	July 28, 2020	⛵Doki operator	Software misconfig	Resource hijacking	Campaign	Stub
Behind the scenes in the Expel SOC: Alert-to-fix in AWS	July 28, 2020	❓Unknown	Unknown	Resource hijacking	Incident	Stub
Meow database server campaign	July 25, 2020	😿Meow	Software misconfig	Data destruction	Campaign	Stub
BlueKai exposed database	June 19, 2020		Software misconfig	Resp. disclosure	Research	Stub
Exim exploitation by Sandworm	May 28, 2020	🐛Sandworm	1-day vulnerability		Campaign	Stub
Large-scale cryptomining attack against K8s clusters detected by Azure	April 8, 2020	❓Unknown		Resource hijacking	Campaign	Stub
Kinsing campaigns (2020)	January 16, 2020	👑Kinsing operator	Software misconfig1-day vulnerability	Resource hijacking	Campaign	Stub
Ubiquiti incident	January 1, 2020	📄Nickolas Sharp	Insider threat	RansomOp	Incident	Finalized
Graboid campaign	October 16, 2019	❓Unknown	Software misconfig	Resource hijacking	Campaign	Stub
Imperva incident	October 10, 2019	❓Unknown	Cloud native misconfig	Data exfiltration	Incident	Finalized
Webmin supply chain attack (2018)	August 15, 2019	❓Unknown	Unknown	Supply chain attack	Incident	Stub
Capital One incident (March 2019)	July 19, 2019	📄Paige Thompson	Cloud native misconfig	Data exfiltration	Incident	Featured
ngrok cryptojacking campaign	September 12, 2018	❓Unknown	1-day vulnerability	Resource hijacking	Campaign	Stub
US DoD NIPRNet access via Atlassian SSRF	April 9, 2018		1-day vulnerability	Resp. disclosure	Research	Stub
Operation Aurora	January 12, 2010	🌩️Storm-0558	Unknown	Data exfiltration	Incident	Stub
Storm-0501 attacking hybrid environments with ransomware				RansomOp	Campaign	Stub