R.C. Manubhai
May 1, 2025
•[ ransomware, data leak ]
Qilin ransomware listed Fijian hardware chain R.C. Manubhai on its leak site, sharing samples (passport scans, salary/loan data) and claiming broader exfiltration; victim confirmation not published at time of report.
Arriva Nederland
May 1, 2025
•[ ddos, hacktivism ]
Arrivas Dutch website was taken offline in a DDoS attack claimed by Russia-aligned hacktivists, with outages acknowledged locally; services were restored after mitigation.
Defense and critical-infrastructure entities in Kazakhstan
May 1, 2025
•[ phishing, data leak, espionage ]
Rare Werewolf APT, a Russia-aligned espionage group, conducted spear-phishing and remote-administration toolbased intrusions in MayJune 2025 targeting defense and critical-infrastructure entities in Kazakhstan, resulting in unauthorized access and data exfiltration.
Defense and critical-infrastructure entities in Ukraine
May 1, 2025
•[ phishing, unauthorized access, data leak ]
Rare Werewolf APT, a Russia-aligned espionage group, conducted spear-phishing and remote-administration toolbased intrusions in MayJune 2025 targeting defense and critical-infrastructure entities in Ukraine, resulting in unauthorized access and data exfiltration.
Corendon
May 1, 2025
•[ ddos ]
Dutch outlet coverage attributed coordinated Russian DDoS attacks against Corendon and Arriva, framed as retaliation for Dutch support to Ukraine; disruptions were temporary.
Dutch public & private organizations
May 1, 2025
•[ ddos, hacktivism, service disruption ]
Russia-aligned hacktivists launched large-scale DDoS causing service disruptions at Dutch public/private orgs; NCSC acknowledged incidents; no internal compromise reported.
Undisclosed financial institution (Asia)
May 1, 2025
•[ ransomware ]
Fog ransomware executed a May 2025 attack against an undisclosed financial institution in Asia, using Syteca (formerly Ekran) and open-source tools GC2, Adaptix, and Stowaway prior to encryption. Symantec confirmed operational disruption but did not report data theft or quantify downtime.
Defense and critical-infrastructure entities in Armenia
May 1, 2025
•[ phishing, data leak, espionage ]
Rare Werewolf APT, a Russia-aligned espionage group, conducted spear-phishing and remote-administration toolbased intrusions in MayJune 2025 targeting defense and critical-infrastructure entities in Armenia, resulting in unauthorized access and data exfiltration.
Undisclosed private company in Granada
May 1, 2025
•[ malware, man-in-the-middle ]
Approximately 13,000 was stolen after malware infected the email account of a private company in Granada, Spain, allowing attackers to monitor correspondence and alter supplier payment instructions. Six individuals were arrested in Spain in connection with the man-in-the-middle fraud.
Santeda International B.V.
May 1, 2025
•[ data breach, credential leak, unencrypted data ]
Investigators reported a data breach affecting MyStake, a Curaao-licensed online casino operated by Santeda International B.V., tracing the exposure back to approximately May 2025. A PDF containing login credentials for 540 MyStake accounts was shared online, and specialists reportedly confirmed they could log into most accounts listed, indicating passwords were still valid long after the leak became known. Once logged in, auditors said they could view sensitive player details stored without encryption, including names, home addresses, phone numbers, dates of birth, and detailed transaction histories. Reporting alleged that users were not notified for more than eight months and that MyStake did not enforce password resets or suspend compromised accounts during that period, increasing risk of account takeover, fraud, and identity misuse.
At least one unnamed European celebrity
May 1, 2025
•[ stalkerware, spyware, data leak ]
A researcher discovered a publicly accessible cloud repository containing 86,859 screenshots from an unnamed European celebrity's device. The files appeared to have been collected through Cocospy-linked stalkerware or spyware installed on the victim's endpoint and included private communications, intimate images, phone usage, business conversations, invoices, payment details, phone numbers, partial credit card numbers, emails, receipts, and identity documents. The dataset appeared to span activity from mid-2024 to mid-2025, but the exact installation or compromise date was not reported; the specific perpetrator was not publicly identified.
City of Tahlequah municipal systems
April 30, 2025
•[ hack, government ]
City of Tahlequah reported a cyberattack; IT isolated affected systems the same day. Officials reported no ransomware encryption and no evidence of data exfiltration or resident impact.
Bartlesville Public Schools
April 30, 2025
•[ hack, education ]
On April 30, 2025, unauthorized intruders stole files from Bartlesville Public Schools containing names and Social Security numbers of staff and students. The breach was discovered by August 4 and reported on August 27. Affected individuals received credit monitoring support.
City Administration of Dresden
April 30, 2025
•[ ddos, government, outage ]
On April 30 2025, the City of Dresdens official websites became inaccessible due to a massive distributed denial-of-service (DDoS) attack. Officials blocked access to protect municipal IT systems, causing full disruption of online services such as parking ticket applications, petitions, and appointment scheduling. A similar outage occurred the previous weekend. No data theft, ransom demand, or perpetrator identification has been reported.
Multiple French government and critical infrastructure organizations
April 30, 2025
•[ espionage, data leak, vulnerability exploitation ]
On April 30 2025, Frances national cybersecurity agency (ANSSI) attributed a campaign of at least twelve cyberattacks on French entities to Russias GRU 85th Main Special Service Center (Unit 26165), known as FANCYBEAR. The espionage activity targeted government, media, energy, and critical-infrastructure organizations via exploitation of vulnerable Cisco routers to gain persistence and exfiltrate sensitive data. No operational disruption was reported.
System Rejestrów Państwowych (Polish State Register System)
April 30, 2025
•[ ddos, hacktivism ]
On April 30, 2025, Polands System Rejestrw Pastwowych, which supports the national tax and registration systems, was targeted by a hacktivist DDoS campaign that caused temporary outages. Access to e-Declarations, CEPiK, and related government portals was disrupted for about one hour. No data theft or encryption occurred, and services were quickly restored.
System Rejestrów Państwowych (Polish State Register System)
April 30, 2025
•[ DDoS, hacktivism, outage ]
On April 30, 2025, Polands System Rejestrw Pastwowych, which supports the national tax and registration systems, was targeted by a hacktivist DDoS campaign that caused temporary outages. Access to e-Declarations, CEPiK, and related government portals was disrupted for about one hour. No data theft or encryption occurred, and services were quickly restored.
ClickFunnels
April 29, 2025
•[ data leak ]
Hackers (Satanic) claimed a breach via a third party and leaked business data.
Army Public Schools (Srinagar and Ranikhet)
April 29, 2025
•[ website defacement, hacktivism ]
Pakistan-based hacktivist IOK Hacker defaced the websites of Army Public Schools in Srinagar and Ranikhet with pro-Pakistan slogans referencing Kashmir; sites were restored shortly after discovery.
Rajasthan Education Department
April 29, 2025
•[ hacktivism, defacement ]
Hacktivist group Pakistan Cyber Force defaced the Rajasthan Education Department website with inflammatory political messages claiming the Pahalgam attack was an inside job; the portal was taken offline and later restored.
