In September 2023 two extortion crews — Rhysida and the short-lived Ransomed.vc — both posted Sony data claims, complete with a Bitcoin auction and a leaked code-signing certificate. Sony investigated; the claimed 6TB scale never verified.
In September 2023 Cisco rushed out patches for CVE-2023-20237, a critical authentication bypass in BroadWorks' single-sign-on flows that could let attackers authenticate as any user. With evidence of active scanning, carrier admins ran an emergency patch marathon.
In September 2023 Scattered Spider vished the MGM helpdesk, pivoted through Okta to ESXi, and detonated ALPHV ransomware — a $100M quarter for MGM while Caesars paid up. The reference incident for helpdesk verification, MFA fatigue, and pay-vs-rebuild economics.
CVE-2023-4863, a heap overflow in libwebp's Huffman decoding, let the BLASTPASS chain install Pegasus via a zero-click iMessage image — and forced every browser, OS, and Electron app on earth to patch the same line of C.