The KeePass Extractor Fight: Memory Beats Crypto
A 2023 PoC scraped the KeePass master password from memory via a rogue DLL; the maintainer called it working as designed. Both were right — and the endpoint-is-the-perimeter lesson stuck.
All articles published by
Hmmnm
Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths. Every technique is explained, tested, and paired with its mitigation — so you learn the attack and the defense together.
git-credential Risks: When Helpers Leak What They Cache
Git’s January 2023 advisory flagged plaintext credential stores and verbose logs echoing 2FA tokens. Developer tooling is production security surface.
SEC v. Binance and Coinbase: Custody Meets Law
The SEC’s June 2023 suits against Binance and Coinbase charged unregistered securities operations at crypto’s two biggest exchanges — a custody and platform-risk story wearing legal clothing.
Genesis Market Takedown: Sessions Are the New Passwords
Operation Cookie Monster seized the market selling browser sessions, cookies, and saved credentials for ~2M identities, with 119 arrests across 17+ countries. Session-security lessons.
LastPass Vault Theft Confirmed: The December Reckoning
LastPass confirmed attackers copied encrypted vault backups after pivoting through a DevOps engineer’s endpoint. KDF legacy and unencrypted metadata set the real risk.
Okta Support Breach 2023: Session Tokens Beat MFA Again
Attackers compromised an Okta support engineer’s personal device, stole the session cookies inside it, and used Okta’s own support console against a customer base estimated at five percent of tenants. BeyondTrust, 1Password, and Cloudflare each detected the downstream activity independently — before the full scope was confirmed.
Ransomware countdown first 24 hours timeline
The First 24 Hours of a Ransomware Attack: Survival Playbook
Change Healthcare lost the claims pipeline of a nation in hours. This minute-by-minute playbook covers hour zero containment, the command structure by hour four, backup verification, pay/no-pay, regulatory clocks — and the non-technical decisions that decide survival.
Midnight Blizzard vs Microsoft: Legacy Tenant to Executive Email
A defunct test tenant, a legacy password without MFA, and a residential-proxy password spray gave Russia’s Midnight Blizzard a foothold inside Microsoft’s own corporate estate in January 2024 — culminating in stolen executive email and a downstream supplier breach wave. This account explains the password-spray tradecraft, how the actors abused OAuth apps to mine mailboxes, why the failure drew a czar-memo mea culpa, and the SEC disclosure mechanics that made the saga public.
23andMe Credential Stuffing: When Relatives Are the Payload
Reused passwords took over 14,000 23andMe accounts, then the DNA Relatives feature amplified the access into profile data for 6.9 million genetically-linked users. The October 2023 breach rewrote breach math: your exposure now includes every relative’s password hygiene.
ChatGPT’s Launch and the Dawn of Prompt Injection
ChatGPT landed November 30, 2022 and hit 100M users in two months — and immediately made prompt injection a practical attack class. Still unsolved in 2026.
Mr. Cooper Mortgage Breach: The Week Payments Stopped
When one of America’s largest mortgage servicers went dark for a week, the harm went far beyond stolen data. The Mr. Cooper incident — detected October 24, disclosed October 31, 2023 — halted payments, escrow, and payoffs for millions of borrowers, and later filings put the notification count near 14.7 million people with Social Security numbers and bank account details in the mix. This account covers the stolen-credential entry, the outage that regulators treated as the real injury, the mortgage-sector dependencies that amplified it, and the durable lessons for any payment-critical firm.
CISO Guide to Ransomware Response Checklist
Ransomware Response Checklist for CISOs
CISO guide to ransomware incident response: a complete checklist covering preparation, detection, containment, eradication, and recovery phases for enterprise environments under active ransomware attacks.
- Go to the previous page
- 1
- …
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- …
- 30
- Go to the next page