GoDaddy’s Multi-Year cPanel Breach: 2.5 Years of Dwell
GoDaddy’s 2023 filing admitted intermittent intruder access since 2020, malware in cPanel servers, and email interception affecting ~6.95M customers.
All articles published by
Hmmnm
Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths. Every technique is explained, tested, and paired with its mitigation — so you learn the attack and the defense together.
ESXiArgs: The Ransomware Wave That EncryptEd Whole Estates
ESXiArgs hit thousands of unpatched VMware ESXi hosts via old OpenSLP bugs in February 2023. Hypervisor ransomware and recovery-script lessons.
T-Mobile API Scraping 2023: 37M Accounts, One Credential
A single compromised API credential let an actor scrape ~37 million T-Mobile accounts over six weeks. Machine-identity governance lessons from a repeat offender.
KeePass Plaintext Export ‘Flaw’: The Trust-Boundary Debate
CVE-2023-24055 showed a config-planted trigger could export KeePass vaults in plaintext after unlock. The debate: feature, flaw, or threat model?
CitrixBleed CVE-2023-4966: Session Tokens Straight From Memory
CVE-2023-4966 let attackers read valid session tokens out of NetScaler memory and inherit authenticated sessions wholesale — MFA already passed. CISA’s Emergency Directive 23-08 forced hunts and rebuilds as LockBit monetized the access.
Sony’s September: Rhysida, Ransomed.vc, and Claim Triage
In September 2023 two extortion crews — Rhysida and the short-lived Ransomed.vc — both posted Sony data claims, complete with a Bitcoin auction and a leaked code-signing certificate. Sony investigated; the claimed 6TB scale never verified.
LAPSUS$ Convictions: Teenagers, Helpdesks, and the GTA VI Leak
A London jury convicted the teenage LAPSUS$ hackers whose SIM swaps, MFA-fatigue pushes, and helpdesk manipulation breached Nvidia, Microsoft, Okta, Uber, and Rockstar — closing the criminal case that proved identity is the real perimeter.
Guardian Ransomware: The Newsroom That Kept Printing
Ransomware forced the Guardian’s newsroom off its networks for weeks in late 2022 — yet print and web kept publishing. Editorial continuity lessons.
SVB’s Collapse: When Banking Becomes a Security Problem
SVB’s March 2023 run froze payroll for half of venture-backed tech and minted a fraud wave targeting displaced customers. Treasury continuity lessons.
Reddit’s Phishing Breach: When MFA Codes Get Phished Too
A cloned intranet page harvested an employee’s password and MFA code, opening hours of internal access. Phishing-resistant MFA and self-report lessons.
Royal Mail vs LockBit: The $80M Ransom Refusal
LockBit encrypted Royal Mail’s international sorting operations in January 2023 and demanded $80M. Royal Mail paid nothing and kept the letters moving.
Rackspace Hosted Exchange Ransomware: The Outage That Killed a Legacy
Rackspace’s December 2022 ransomware incident took Hosted Exchange down for weeks, ended the product’s life, and cost $12M+. Legacy platform lessons.
- Go to the previous page
- 1
- …
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- …
- 30
- Go to the next page