Attack Research Database
The cyber attacks and cloud incidents have been creating massive damage to the organizations' confidential and credible information. Learn more about the latest attacks and the associated ransom costs.

Did you Know?
According to the latest IBM cloud attack report – each cloud attack costs $3.92M on an average
Attack Research
Attack Type

Join 18K+ community

APT43 Hackers Targeting Academic Institutions Using Exposed Credentials
APT43, also known by aliases such as Black Banshee, Emerald Sleet, and Kimsuky, is a North Korean state-sponsored cyber threat actor linked to the Reconnaissance General Bureau (RGB).
ATTACK COST

Massive OpenAI Leak, WordPress Admin Exploit, Inkafarma Data Breach
SOCRadar’s Dark Web Team has detected a wave of cyber threats on hacker forums this week, including an alleged leak of millions of OpenAI user accounts. Meanwhile, a WordPress admin exploit script, WPU 2.0, is being sold, offering features to bypass security measures and manipulate websites.
ATTACK COST
Not disclosed

BadIIS Malware Exploits IIS Servers for SEO Fraud
A newly uncovered cyber campaign has been observed exploiting Internet Information Services (IIS) vulnerabilities to distribute malware known as BadIIS.
ATTACK COST
Not disclosed

IntelBroker is Allegedly Selling the Data of InkaFarma
A hacker known as IntelBroker claims to have breached InkaFarma, Peru’s largest pharmaceutical retail chain, leaking a massive 3.9 million-record database. The alleged breach, which surfaced on February 6, 2025, was posted on a well-known cybercrime forum, with the attacker providing sample data to prove authenticity.
ATTACK COST
Not disclosed

New 'Sneaky 2FA' Phishing Kit Targets Microsoft 365 Accounts with 2FA Code Bypass
Cybersecurity researchers have detailed a new adversary-in-the-middle (AitM) phishing kit that's capable of Microsoft 365 accounts with an aim to steal credentials and two-factor authentication (2FA) codes since at least October 2024.
ATTACK COST
Not disclosed

Chinese Hackers Accessed Yellen's Computer in US Treasury Breach
US Treasury Secretary Janet Yellen’s computer was infiltrated and unclassified files were accessed as part of a broader breach of the agency by Chinese state-sponsored hackers, according to two people familiar with the matter.
ATTACK COST
Not disclosed

Belsen Group Leaks 15,000+ FortiGate Firewall Configurations
FortiGate firewall leak exposes 15,000+ configurations, impacting organizations globally. The actor behind the leak is Belsen Group. Learn how to mitigate risks and protect your systems.
ATTACK COST
Not disclosed

UnitedHealth confirms 190 million Americans affected by Change Healthcare data breach
UnitedHealth has confirmed the ransomware attack on its Change Healthcare unit last February affected around 190 million people in America — nearly double previous estimates.
ATTACK COST
Not disclosed

AI Could Generate 10,000 Malware Variants, Evading Detection in 88% of Case
Cybersecurity researchers have found that it's possible to use large language models (LLMs) to generate new variants of malicious JavaScript code at scale in a manner that can better evade detection.
ATTACK COST
Not disclosed

Governments need to work as one to counter cyber threats in 2025
The report warns that AI will be used to develop highly sophisticated, personalized phishing campaigns using deepfake technology, making them harder to detect.
ATTACK COST
Not disclosed

NoviSpy Spyware Installed on Journalist's Phone After Unlocking It With Cellebrite Tool
A Serbian journalist had his phone first unlocked by a Cellebrite tool and subsequently compromised by a previously undocumented spyware codenamed NoviSpy, according to a new report published by Amnesty International.
ATTACK COST
Not disclosed

DeceptionAds Delivers 1M+ Daily Impressions via 3,000 Sites, Fake CAPTCHA Pages
Cybersecurity researchers have shed light on a previously undocumented aspect associated with ClickFix-style attacks that hinge on taking advantage of a single ad network service as part of a malvertising-driven information stealer campaign dubbed DeceptionAds.
ATTACK COST
Not disclosed

How China Hacked America’s Phone Network
An alarming new hack by China has penetrated the nerve center of the United States: its telephone network.
ATTACK COST
Not disclosed

Romania's election systems targeted in over 85,000 cyberattacks
A declassified report from Romania’s Intelligence Service says that the country’s election infrastructure was targeted by more than 85,000 cyberattacks.
ATTACK COST
Not disclosed

WotNot exposes 346K sensitive customer files
Hello, this is your chatbot leaking: WotNot exposes 346K sensitive customer files
ATTACK COST
Not disclosed

Starbucks Hit by Ransomware Attack via Third-Party Software Supplier
Ransomware Attack on Software Supplier Disrupts Operations for Starbucks and Other Retailers A ransomware attack that hit a major software provider last week caused disruptions for a handful of companies over recent days, from Starbucks to U.K. grocery giant Morrisons
ATTACK COST
Not disclosed

Russian Spies Jumped From One Network to Another Via Wi-Fi in an Unprecedented Hack
In a first, Russia's APT28 hacking group appears to have remotely breached the Wi-Fi of an espionage target by hijacking a laptop in another building across the street.
ATTACK COST
Not disclosed

The AI Effect: Amazon Sees Nearly 1 Billion Cyber Threats a Day
The technology has spawned a surge in hacking attempts, says cyber chief CJ Moses, while Amazon is also using it to powerfully amp up its threat-analysis capability
ATTACK COST
$1 billion

Ransomware Gang demands $125,000
A new ransomware player opted to ask a victim for payment in French bread. But don’t be fooled by the apparent humor, the Hellcat crime group is deadly serious and wants $125,000 in the cryptocurrency Monero as well.
ATTACK COST
$125,000

The Rhysida group targeting Easterseals demanding 20 bitcoins
Ransomware gang stoops to new low, targets prominent nonprofit for disabled people A notorious ransomware gang previously responsible for attacks on multiple hospitals has now claimed a new victim: disability nonprofit Easterseals.
ATTACK COST
$1.3 million

Russia-based ransomware gang that demanded $22 million on Healthcare system
Change Healthcare cyber attack affected 100 million individuals. Senate Finance Committee Chair seeks further information on Change Healthcare cyber attack.
ATTACK COST
$22 million

Providence Students’ Data Exposed in Cyberattack
The Providence, Rhode Island, school district fell victim to a cyberattack last month. A ransomware gang uploaded sensitive student information to an instant messaging service after Providence Public Schools did not pay their $1 million extortion demand.
ATTACK COST
$1 million

The Rhysida gang demand $1.5M for patient data targeting Colorado based health system
Axis Health System, a network of 13 behavioral health facilities in Colorado, followed incident response protocol after identifying the attack and its investigation is ongoing. The system has not confirmed whether patient data was affected.
ATTACK COST
$1.58 million

AT&T, Verizon reportedly hacked to target US govt wiretapping platform
Multiple U.S. broadband providers, including Verizon, AT&T, and Lumen Technologies, have been breached by a Chinese hacking group tracked as Salt Typhoon, the Wall Street Journal reports.
ATTACK COST
Not disclosed

Detailed Microsoft research based on ransomware at Healthcare sector
US Healthcare at risk: Strengthening resiliency against ransomware attacks. The healthcare sector faces a rapidly increasing range of cybersecurity threats, with ransomware attacks emerging as one of the most significant.
ATTACK COST
$4.4 million

Ransomware attack on Indian payment system traced back to Jenkins bug
Researchers have discovered that a damaging ransomware attack on a digital payment system used by many of India’s banks began with a vulnerability in Jenkins — a widely used open-source automation system for software developers.
ATTACK COST
Not disclosed

WazirX Cryptocurrency Exchange Loses $230 Million in Major Security Breach
Indian cryptocurrency exchange WazirX has confirmed that it was the target of a security breach that led to the theft of $230 million in cryptocurrency assets.
ATTACK COST
$230 million

CVE-2024-5655
Allows attackers to run pipelines as any user, which can lead to unauthorized access and potentially harmful actions within the GitLab CI/CD environment.
ATTACK COST
Not disclosed

Change Healthcare Ransomware Attack
A DDoS attack by Anonymous Sudan targeted over 300 web domains and 177,000 IP addresses, disrupting major public service websites.
ATTACK COST
$1.6 billion

UK Ministry of Defence Payroll Hack
Personal data of nearly 270,000 current and former staff members, including identities, bank details, and addresses, were exposed due to a hack on the payroll system managed by SSCL.
ATTACK COST
270K PII Disclosed

CrushFTP Zero-Day Cloud Exploit
Unauthenticated attackers exploit a sandbox escape flaw in the CrushFTP server (CVE-2024-4040) to download system files and potentially achieve Remote Code Execution (RCE).
ATTACK COST
Not disclosed

Kubernetes RCE Attack
Microsoft discovered critical vulnerabilities in OpenMetadata versions 1.2.4 and 1.3.1, exploited by attackers to execute remote code on Kubernetes clusters. These vulnerabilities allowed hackers to gain access to vulnerable environments and deploy cryptocurrency mining malware.
ATTACK COST
Not disclosed

Palo Alto Networks Zero-day Exploit
Proof-of-concept (PoC) exploits released for the maximum-severity vulnerability in Palo Alto Networks' PAN-OS used in GlobalProtect gateways. Attackers can achieve remote code execution by exploiting a chain of vulnerabilities, including directory traversal and command injection.
ATTACK COST
Not disclosed

Supply Chain Attack
A sophisticated attack targeting the Kubernetes supply chain, where attackers injected malicious code into container images used by various organizations. This code allowed attackers to access deployment configurations and sensitive data.
ATTACK COST
$2 million

French State DDoS Attack
A DDoS attack by Anonymous Sudan targeted over 300 web domains and 177,000 IP addresses, disrupting major public service websites.
ATTACK COST
Not disclosed

Rhysida Ransomware
MarineMax (luxury yacht dealer and boating lifestyle brand) earnings reports, balance sheets, bank account wire transfers, customer databases, and other financial documents compromised
ATTACK COST
15BTC
(roughly $919k)

Medusa Ransomware
Illinois’ Monmouth College system were compromised giving access to info like driver’s licenses and ID cards among a host of other information
ATTACK COST
$500 k

Russian website builder data leak
54 million users of the uID.me website builder had their data exposed due to a misconfigured MongoDB database.
ATTACK COST
Not disclosed

Container Escape Vulnerability
Attackers exploited a container escape vulnerability within the Kubernetes environment of a healthcare provider, gaining access to host systems and compromising patient data. The vulnerability allowed attackers to break out of the container and execute commands on the host operating system.
ATTACK COST
$5 million

BlackCat Ransomware
6TB of data stolen from Change Healthcare's network belonging to "thousands of healthcare providers, insurance providers, pharmacies, etc.”
ATTACK COST
$22 million

Hipocrate Information System (HIS)
Ransomware attack forces 100 Romanian hospitals to go offline
ATTACK COST
3.5 BTC
(roughly $167 k)

ArcaneDoor hackers exploit Cisco zero-days to breach govt networks
Exploitation of two zero-day vulnerabilities (CVE-2024-20353 and CVE-2024-20359) in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) firewalls, leading to cyber-espionage activities targeting government networks worldwide.
ATTACK COST
Not disclosed

MITRE was breached through Ivanti zero-day vulnerabilities
MITRE Corporation breached by nation-state hackers utilizing zero-day vulnerabilities in Ivanti Connect Secure products. Attackers performed reconnaissance through VPNs and laterally moved into VMware infrastructure. Compromised systems used for storage, computing, and networking resources.
ATTACK COST
Not disclosed

Sophisticated state-sponsored attackers believed to be based out of North Korea
Orbit Chain's balance went from $115 M to $29 M instantly
ATTACK COST
$86 million

DarkBeam Misconfiguration
A misconfigured Elasticsearch and Kibana interface exposed 3.8 billion data records, including user emails and passwords, making them vulnerable to phishing campaigns.
ATTACK COST
Not disclosed

Zimbra Zero-Day
A zero-day vulnerability in the Zimbra Collaboration Suite was exploited to gain unauthorized access to email accounts, leading to data theft and espionage.
ATTACK COST
Not disclosed

ICMR Data Breach
The personal data of 815 million Indian residents was compromised, including names, ages, genders, addresses, passport numbers, and Aadhaar numbers.
ATTACK COST
Not disclosed

23andMe Credential Stuffing Attack
Credential stuffing attacks resulted in the leakage of data from 20 million genetic profiles. Initial leaks included data on Ashkenazi Jews, with subsequent leaks affecting UK and German residents.
ATTACK COST
Not disclosed

Scattered Spider
Guest info (social security number and passport number) stolen
ATTACK COST
$100 million hit to
the Q3 revenue

Cryptocurrency Mining Attack
Aqua Security uncovered that misconfigurations in Kubernetes clusters led to significant security breaches. Attackers exploited these misconfigurations to deploy cryptocurrency mining operations within compromised clusters.
ATTACK COST
Not disclosed

Salesforce Zero-Day Exploited to Phish Facebook Credentials
Guardio researchers detected cyberattackers sending targeted phishing emails with @salesforce.com addresses using the legitimate Salesforce infrastructure. An investigation revealed that they were able to exploit a Salesforce email-validation flaw to hide behind the domain's trusted status with users and email protections alike.
ATTACK COST
Not disclosed

MOVEit Transfer Zero-Day
Exploited a zero-day vulnerability in the MOVEit Transfer software, compromising sensitive data transfers and resulting in large-scale data breaches.
ATTACK COST
Not disclosed

Log4Shell
This zero-day vulnerability in the Apache Log4j library allowed attackers to execute arbitrary code on affected systems. It compromised critical infrastructure, including cloud services, financial institutions, and government agencies.
ATTACK COST
Not disclosed

Spring4Shell
This zero-day vulnerability in the Spring Framework allowed attackers to execute remote code on affected servers. It was exploited to deploy malware and gain unauthorized access to sensitive information.
ATTACK COST
Not disclosed

Log4j Hack on ONUS
Significant financial and reputational damage to ONUS; Nearly 2 million customer records put up for sale, including E-KYC information and hashed passwords.
ATTACK COST
$5 million

QakBot attacks with Windows zero-day (CVE-2024-30051)
In early April 2024, researchers discovered a new zero-day vulnerability (CVE-2024-30051) in the Windows Desktop Window Manager (DWM). The vulnerability allows for privilege escalation to gain system privileges. It was found while investigating a previous zero-day (CVE-2023-36033). By mid-April, an exploit for CVE-2024-30051 was detected being used in conjunction with QakBot malware and potentially by multiple threat actors. Microsoft released a patch for this vulnerability on May 14, 2024, as part of Patch Tuesday.
ATTACK COST
Not disclosed
All Advanced Attacks are Runtime Attacks
Zero Trust Security
Code to Cloud
AppSec + CloudSec

Prevent attacks before they happen
Schedule 1:1 Demo