2022 – Page 4

Lapsus$ vs Microsoft: When Teen Hackers Beat a Hyperscaler’s Odds

37GB claimed, one account compromised, no customer data lost — and a DEV-0536 profile that taught the industry how social engineering beats MFA.

North Korea's Lazarus Group drained Axie Infinity's Ronin bridge of $625M with five forged signatures and a leftover permission nobody revoked.

One contractor's stolen credentials reached super-admin support tooling across 366 Okta tenants. The identity supply chain's hardest lesson.

One stale pipe flag let unprivileged users overwrite read-only files — /etc/passwd included — for 18 months on every modern Linux kernel.

One contractor's credentials, 190 GB of Galaxy bootloader and biometrics code, and the pure steal-and-dump model that outlived encryption ransomware.

A pro-Russia statement, a furious insider, and the full Jabber archive of history's most damaging ransomware brand — dumped for everyone to read.

Seventeen users, one fake migration flow, and $1.7M in Apes gone — the phishing heist that made signature UX a security discipline.

Hours before tanks rolled, a signed wiper shredded hundreds of Ukrainian networks. The anatomy of the first invasion-synced destructive campaign.

OMB's January 2022 mandate gave zero trust deadlines, named technologies, and an oversight structure — rewriting industry roadmaps worldwide.

CVE-2021-4034 gave instant root on default Linux installs via pure logic flaw. Why setuid code still deserves emergency attention.

No zero-days, no malware — just MFA fatigue, SIM swaps, and help-desk social engineering. How Lapsus$ broke every assumption.

Attackers defeated the second factor, not the vault, draining $34M from 483 accounts before a platform-wide withdrawal halt stopped them.