Hackmanac Cyber Alerts

🟧 #HackTuesday 🟧 Hack Tuesday: Week 11 - 17 December 2024 ⚠️212 cyberattacks across 47 countries ⚠️ ➡️The most active threat actor this week is FunkSec claiming responsibility for 22 cyberattacks. ➡️The 🇺🇸USA is the most affected country, accounting for 39% of the victims, with 82 cyberattacks. ➡️The Manufacturing sector is the most impacted, representing 16% of the claimed targets. ➡️The estimated Critical cyberattacks account to 38 (18% of the total). ➡️Overall, the claimed compromised data amounts to approximately 39 TB. ☣️The average ESIX® (Estimated Severity Index) is 4.16, a -7.56% drop from last week. Follow the link for list of attacks (claims or disclosures): https://hackmanac.com/news/hack-tuesday-week-11-17-december-2024 #Hackmanac #HT #Cybersecurity

🚨Cyberattack Alert🚨 USA - Kurita America ThreeAM ransomware group claims responsibility for the cyberattack on Kurita America. The company suffered a ransomware attack on November 29, 2024. https://therecord.media/us-subsidiaries-japanese-water-treatment

🚨Cyberattack Alert ‼️ 🇵🇹Portugal - Município de Chaves Qilin ransomware group claims to have breached Município de Chaves.

🚨Cyberattack Alert ‼️ 🇧🇷Brazil - A GERADORA Akira ransomware group claims to have breached A GERADORA. Allegedly, 130 GB of data, including contact and e-mail information, personal information, financial information, and company bylaws, were exfiltrated.

🚨Cyberattack Alert ‼️ 🇧🇷Brazil - Ouro Verde Fog ransomware group claims to have breached Ouro Verde. Allegedly, 4 GB of data, including employee and customer contact phones and emails, inside financial documents, and customers' CNPJ/CPF numbers, were exfiltrated.

🚨🚨Data Breach Alert - AlphaSense A potential data breach at AlphaSense, a market intelligence platform, has been detected on a hacking forum. A ransom of 10 BTC has been demanded. According to the post, the threat actor known as KryptonZambie claims to possess the full database, full source code, and complete access to AlphaSense's system. Multiple samples have been provided. The ransom demand to remove the data is 10 BTC. The confirmation or denial of these claims has yet to be verified.

🚨🚨Cyberattack Alert ‼️ 🇺🇸USA - Heritage Bank Interlock ransomware group claims to have breached Heritage Bank. Allegedly, 470 GB (860,772 files) of data, including confidential banking documents, personal data of employees and customers, credit reports, technical documentation, and ATM statements, were exfiltrated.

🚨Cyberattack Alert ‼️ France - Ecritel Hunters International hacking group claims to have breached Ecritel, a provider of managed hosting services. Allegedly, 135.1 GB of data (81,674 files), including financial data, customers' data, PII, and databases, were exfiltrated. Ransom deadline: 19th Dec 24.

🚨Phishing Alert 🚨 🇪🇸Spain - A phishing campaign impersonating INCIBE targets individuals in Spain, using emails with fake allegations of investigations related to pornography. - INCIBE is NOT reporting on ongoing investigations related to pornography - More details: https://www.incibe.es/ciudadania/avisos/incibe-no-esta-informando-sobre-investigaciones-en-curso-relacionadas-con

🚨Cyberattack Alert ‼️ 🇺🇸USA - Brockton Neighborhood Health Center Interlock ransomware group claims to have breached Brockton Neighborhood Health Center. Allegedly, 1.93 TB of data (4,083,080 files), including SQL databases and a collection of confidential documents of patients and employees, were exfiltrated.

🚨Cyberattack Alert ‼️ 🇰🇷South Korea - Simmtech The Underground ransomware group (the same group behind the CASIO cyberattack) claims to have breached Simmtech, a company that develops and manufactures high-layer PCBs for semiconductors. Allegedly, 745.1 GB of data were exfiltrated.

🚨Cyberattack Alert ‼️ 🇵🇱Poland - Scania RansomHub ransomware group claims to have breached the Polish branch of Scania, a global company offering trucks, buses, and services in over 100 countries worldwide. Allegedly, 1.2 TB of data were exfiltrated. Ransom deadline: 25th Dec 24.

🚨🚨🚨Cyberattack Alert ‼️ 🇪🇸Spain - Hackers paralyze dozens of municipalities in Madrid. Ransom demanded. More details: https://www.abc.es/espana/madrid/hackers-bloquean-decenas-municipios-madrid-exigir-rescates-20241215172353-nt.html

🚨Cyberattack Alert ‼️ 🇸🇦Saudi Arabia - Aflak Electronic Industries RansomHub ransomware group claims to have breached Aflak Electronic Industries. Allegedly, 20 GB of data were exfiltrated. Ransom deadline: 22nd Dec 24.

🚨Cyberattack Alert ‼️ Nigeria - Government of Ekiti State FunkSec hacking group claims to have breached Government of Ekiti State. Allegedly, 300 MB of documents were exfiltrated and leaked.

🚨Cyberattack Alert ‼️ 🇫🇷France - Concession Peugeot Cicaca3301 ransomware group claims to have breached Concession Peugeot. Allegedly, 35 GB of data were exfiltrated. Ransom deadline: 06th Jan 24.

🚨Following Cleo vulnerability exploitation, the Cl0p ransomware group releases a message. 🚨 After CISA's confirmation that a critical vulnerability (CVE-2024-50623) in Cleo Harmony, VLTrader, and LexiCom file transfer software is being exploited in ransomware attacks, the Cl0p ransomware group released a message on its data leak site: "Dear companies Due to recent events (attack on CLEO) all links to data of all companies will be disabled and data will be permanently deleted from servers. We will work only with new companies." As pointed out by BleepinComputer, the vulnerability exploited bears similarities to previous Cl0p ransomware campaigns targeting MOVEit Transfer, GoAnywhere MFT, and Accellion FTA. At least 50 Cleo hosts and over two dozen companies have been affected.

🇯🇵Japan - Hacker Sends Email Confirming Receipt of $3 Million to KADOKAWA KADOKAWA, a major publishing company in Japan, suffered a significant cyberattack in June 2024, allegedly by the Russian hacker group BlackSuit. On December 12, it was revealed that the hackers sent emails to KADOKAWAexecutives claiming to have received $2.98 million in cryptocurrency as ransom. Security firm Unknown Technologies confirmed a $2.98 million transaction on the internet in June, sparking debate about KADOKAWA's response to the attack. Despite this, the hackers ultimately leaked the stolen internal information. Source: https://nordot.app/1239845288355070702

🚨Cyberattack Alert ‼️ 🇸🇦Saudi Arabia - Hashem Contracting RansomHub ransomware group claims to have breached Hashem Contracting. Allegedly, 91 GB of data were exfiltrated. Ransom deadline: 22nd Dec 24.

⚠️🚨New hacking group detected operates the data leak site called "LEAKEDDATA." 🚨⚠️ The blog lists 30 companies allegedly breached by the group, including names like Marriott International, Hannover Re, and Essex Property Trust. Furthermore, it seems the group is preparing to publish the names of at least 13 additional victims. An initial analysis suggests the group has a strong interest in legal and accounting activities in the United States. Further details about the group behind this series of claims will be discussed as soon as they become available.