A brief history of collective distortions

There are cyber security tools for institutions, such as routers, protection walls, and VPN walls, to protect corporate networks from infiltrators and malnacles, which is especially important in this afternoon of widespread remote work.

But although the tools that help institutions to stay safe from external threats, many of these products have repeatedly to contain programs that allow malicious wicked wet wet toe to be designed to protect them.

These mistakes were blamed An explosion in Big campaigns In recent years, as the use of malicious infiltrators offends, these security defects are easy to dispense with the networks of thousands of organizations and steal the sensitive company data.

We have collected a brief history of group aid, and we will update this article when more appears.

One of the first great phone phone in this contract was seen The reputable ransom crew takes advantage of a vulnerability in Fortra Administrative file transfer program, a product that companies use to share large files and sensitive data groups online. The Clop Ransomware Gang has taken advantage of abundant defects to settle more than 130 organizations and steal personal data for millions of individuals. Weakness was exploited as a zero day, which means that Fortra had no time to repair it before he was attacked. Klopp later published the stolen data from the victims’ organizations that did not pay the infiltrators ransom. Hitachi Energy, Security giant RobrickFlorida’s health technology organization, based in the Nationalfits- Which witnessed the data of more than three million members stolen in the attack – Reporting the breakthroughs resulting from the animal cart.

May 2023: Moveit defects allowed 60 million data to steal

the A large block of moveit It is still one of The largest group roots in all agesWith the abuse of infiltrators to a defect in another program to transfer the files used widely, developed by the Progress program, to steal data from several thousand organizations. The attacks were once again demanded by the Clop Ransomware Group, which took advantage of the Moveit vulnerability to steal data on more than 60 million people, according to the Cyber ​​Security Company Emsisoft. MAXIMUS Giant US government services was the largest victim of Moveit breach after confirming that the infiltrators had reached the health information protected by Up to 11 million people.

October 2023: Cisco Zero-Day shows thousands of routers to acquire

The mass mass continued in the second half of 2023, with Hunters who take advantage of a security vulnerability are not available in the CISCO network in Cisco Throughout the month of October, to settle tens of thousands of program -based devices, such as the keys to institutions, wireless control units, arrival points, and industrial routers. The error gave the attackers “full control over the exposed device.” While CISCO has not confirmed the number of customers affected by the defect, Concys, a search engine for devices and assets connected to the Internet, says it has noticed approximately 42,000 Internet exposure devices.

November 2023: Ransomware Gang takes advantage of Citrix Bug

Citrix Netscale, which is used by companies and large governments to deliver the application and connect VPN, has become, The last goal of this is a collective Just one month later in November 2023. The error, known as “Citrixbleed”, allowed the Ransomware gang associated with Russia to extract sensitive information from NetScaler systems affected by large companies. Boeing, the giant of space, the Allen & Overy, and the Chinese Industrial and Commercial Bank as victims.

January 2024: Chinese infiltrators took advantage of Ivanti VPN errors to violate companies

Ivanti has become a synonym for the population after the infiltrators supported by the Chinese state Collective separation began Two critical weaknesses on zero day at Ivanti Corporate Connect Secure VPN. While Ivanti said at the time that only a limited number of customers was affected, the Volexity Security Company found that more than 1700 Ivanti devices around the world were exploited, affecting organizations in the field of space, banking services, defense and communications. And he ordered US government agencies with IVANTI systems affected by operation immediately Take the systems out of service. Since then, the exploitation of these weaknesses was linked To the China -backed espionage group known as Hurricane saltAnd that was recently found to have been hacked for at least the networks of American telecommunications companies.

In February 2024, infiltrators Take the target In two “easy to dispense” weaknesses in Screenwise, a famous access tool that allows it and support technicians to provide technical assistance on customer systems. The cybersecurity giant Mandyante said at the time, her researchers have noticed “collective exploitation” of defects, who were abused by various representatives of threats to spread password stealing, back, and in some cases, ransom.

IVANTI customers (again) hit fresh errors

IVANTI is the headlines again – also in February 2024 – when the attackers took advantage of another twice in the widely used VPN Enterprise device To strike its customers. ShadowSErver, a non -profit organization that wipes and monitors the Internet for exploitation, has noticed the time when it noticed more than 630 unique IP addresses trying to exploit the server defect, allowing the attackers to access devices and systems outwardly protected by Ivanti weak devices.

November 2024: Pallo Alto insect insects are at risk

Later in 2024, infiltrators on thousands of organizations were exposed by exploitation Two weaknesses on the zero day In the programs made by Palo Alto Networks, the giant Cyber ​​Security, which customers use all over the world. Pan-SOS weaknesses, the operating system that works on all the next Palu Alto protection walls, allowed attackers to waive sensitive data and exceed them from corporate networks. according to Researchers at Watchtowr Labs for Security Company Those who corrected Palo Alto stains resulted from the basic errors in the development process.

December 2024: CLOP hurts the clients of Cleio

In December 2024, the Clop Ransomware gang targeted another technology to transfer the famous files to launch a new wave of collective breakthroughs. This time, the gang Tired disadvantages In the tools created by Cleo Software, the institution’s programmaker in Illinois, to target dozens of company customers. By early January 2025, Klopp included nearly 60 Cleo companies It may be at risk, including the American Blue Supply Series Series Giant Yonder and the German -manufactured Covestro giant. By the end of January, Klopp added 50 other victims of the Premier Cleo to the dark web leakage site.

January 2025: New Year, New Ivanti Bugs under attack

The New Year started with the falling Evante for the infiltrators – once again. The American software giant alerted clients in early January 2025 that the infiltrators were taking advantage of a security vulnerability on a zero day in the institutional VPN to violate its customers ’networks. Evante said that “a limited number” of customers were affected, but he refused to specify the number of number. Shadowerver Foundation She says her data Hundreds of customer customer systems.

Fortinet Wall insects have been exploited since December

A few days after revealing the latest error from IVANTI, Fortinet confirmed that infiltrators were using separately in their protection walls to storm their customers and institutions. The defect, which affects the walls of protection in the cybersecurity, was. The mass was “exploited” as a zero insect from less than December 2024According to security research companies. Fortinet refused to determine the number of customers who were affected, but security research companies that are achieved in observable attacks that affect the “dozens” of affected devices.

Sonicwall says that infiltrators penetrate distance agents

January 2025 remained a month crowded for infiltrators who take advantage of errors in the security program. Sonikwal said in late January that the infiltrators who have not yet identified a newly discovered security vulnerability in one of its products to institutions To storm customer networks. The weakness, which affects the SMA1000, was discovered to get a distance from Sonicwall, by the threat researchers in Microsoft and confirmed that it was actively exploited in the wilderness, “according to Soniol. Confirm, but with More than 2,300 devices exposed to the InternetThis error has the ability to be the latest comprehensive for 2025.