By March 2021 REvil paired a record $50M Acer demand with leak-site auctions and affiliate economics — industrialised extortion at its zenith. How the machine worked and why every brand since runs its playbook.
A CVSS 9.8 unauthenticated RCE in BIG-IP iControl REST was mass-exploited within a day of disclosure — web shells, credential theft, coinminers on the boxes that hold your TLS keys. The edge-device patch-race case study.
Teenage hackers turned one exposed Verkada dev server into super-admin access over ~150,000 customer cameras — hospitals, jails, Tesla, Cloudflare. The third-party camera risk case that rewrote vendor security questionnaires.
Four zero-days in on-premises Microsoft Exchange let HAFNIUM and ten follow-on crews own mail servers at tens of thousands of organisations. The anatomy of the SSRF-to-web-shell chain, the PATCH NOW scramble, and why patching was not remediation.
HelloKitty ransomware encrypted CDPR's network and stole Cyberpunk 2077 and Witcher 3 source code — then auctioned it on a crime forum after the studio refused to pay. The incident file on IP extortion, auction economics, and the no-ransom playbook.
No exploits, no stolen credentials — Alex Birsan's February 2021 research got code executed inside 35+ major companies by registering their internal package names on public registries and letting version arithmetic do the rest. The incident file on the cheapest supply-chain attack ever demonstrated.
Google's February 2021 emergency Chrome patch opened a record zero-day year. This incident file breaks down how the V8 heap overflow worked, how it chained with a sandbox escape, why watering-hole delivery leaves no trace, and what fleet-level browser defenses it forced.
A remote intruder raised a Florida treatment plant's lye setpoint from 100 to 11,100 ppm and an operator watching the screen reverted it in minutes. The incident file on shared passwords, exposed TeamViewer, and why OT security failed at a municipal water utility.
The incident file on Operation Ladybird: how eight countries dismantled Emotet's 700-server botnet from inside its own update mechanism, why the loader-as-a-service model made Emotet the on-ramp for Ryuk and Conti ransomware, how the brand was rebuilt from TrickBot within ten months, and what the takedown teaches about the ceiling of law-enforcement disruption.
How a privacy-policy notice nobody had read moved millions of users to Signal and Telegram in a week, what WhatsApp actually changed (and what it did not), and why platform-trust collapse is a security event enterprises must plan for.
Days after SUNBURST, researchers caught attackers exploiting a 9.8-severity SQL injection in SonicWall SMA 100 appliances — including against SonicWall's own network. This incident file covers how unauthenticated credential extraction turned edge appliances into ransomware on-ramps.
The full incident file on the SolarWinds SUNBURST supply-chain attack: how SVR-linked actors compromised the Orion build pipeline, trojanized signed updates reaching 18,000 customers, hand-picked under 100 targets including nine US federal agencies, and forged SAML tokens to persist. Includes the technical anatomy, timeline, impact numbers, and the build-pipeline hardening lessons that still define defender programs in 2026.