Author: Prabhu Kalyan Samal

This author has written 359 articles
Hmmnm
All articles published by

Hmmnm

Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths. Every technique is explained, tested, and paired with its mitigation — so you learn the attack and the defense together.

Learning Paths · About Hmmnm · Editorial policy

Read more about the article Polyfill.io Hijack: 100,000+ Sites Inherited a Malicious Script

Polyfill.io Hijack: 100,000+ Sites Inherited a Malicious Script

When Sansec disclosed in late June 2024 that the polyfill.io domain had been sold and its hosted script rewritten to inject mobile-only scam redirects, hundreds of thousands of embedded sites — WordPress themes among them — discovered they had inherited an implant, invisible to desktop QA by design. This account traces the Funnull acquisition chain, the conditional payload mechanics, Cloudflare’s mirror intervention, the DNS-harassment retaliation, the 2025 arrests, and the inventory lesson every site owner still owes themselves.

Continue ReadingPolyfill.io Hijack: 100,000+ Sites Inherited a Malicious Script
Read more about the article Brain Cipher vs Indonesia’s Data Centers: A National Ransomware Reckoning

Brain Cipher vs Indonesia’s Data Centers: A National Ransomware Reckoning

In June 2024, the Brain Cipher crew — running a LockBit 3.0 builder clone — encrypted Indonesia’s National Data Center, disrupting 200+ government services from immigration to licensing, then released a decryptor with an apology-flavored admission that extortion failed, then hit again during recovery. This account covers the copycat-crew economics behind the operation, why one shared-tenant data center meant national outage, the second-encryption lesson about persistence, and the segmented-architecture rebuild Indonesia promised next.

Continue ReadingBrain Cipher vs Indonesia’s Data Centers: A National Ransomware Reckoning
Read more about the article Snowflake Extortion: 165+ Customers, One Credential Wave

Snowflake Extortion: 165+ Customers, One Credential Wave

On June 19, 2024, Mandiant’s public advisory named UNC5537 as the crew behind the Snowflake extortion wave — 165+ victim organizations entered with infostealer credentials against MFA-less tenants, datasets extorted through listings and a dedicated leak market researchers dubbed Snow:Bay. This piece condenses the TTP catalogue, the backyard economics of stolen logs, the aftermarket that changed notification obligations forever, and the single control that would have prevented every confirmed intrusion.

Continue ReadingSnowflake Extortion: 165+ Customers, One Credential Wave
Read more about the article Snowflake-Ticketmaster: The Cloud-Secure Myth Breaks

Snowflake-Ticketmaster: The Cloud-Secure Myth Breaks

Live Nation’s May 2024 SEC filing confirmed criminal access to roughly 560 million Ticketmaster customer records — taken not by exploiting Snowflake but by logging into it with infostealer-derived credentials on a tenant without MFA. This account explains the UNC5537 tradecraft that chained $20 stealer logs into Fortune-500 data lakes, why the ‘no Snowflake breach’ defense only half-worked, what the ~560M-record dataset contained, and the mandatory-MFA wave that reshaped SaaS identity through 2024.

Continue ReadingSnowflake-Ticketmaster: The Cloud-Secure Myth Breaks
Read more about the article Windows Recall: The Privacy Debate Before Launch

Windows Recall: The Privacy Debate Before Launch

Announced May 20, 2024 as a Copilot+ flagship, Windows Recall promised searchable memory of everything on screen — and researchers found the archive in a plaintext SQLite database any user-context malware could read, with a runtime API to match. This account covers Kevin Beaumont’s teardown, the TotalRecall extraction tool, the threat-model fallacies in each Microsoft defense, the June climb-down to opt-in plus Windows Hello and encryption, and the rare process win of an architecture changed before deployment.

Continue ReadingWindows Recall: The Privacy Debate Before Launch
Read more about the article CrushFTP VFS Sandbox Escape: Zero-Trust Patch Confusion in File Transfer

CrushFTP VFS Sandbox Escape: Zero-Trust Patch Confusion in File Transfer

On April 19-20, 2024, CrushFTP shipped emergency fixes for CVE-2024-4040 — an unauthenticated escape from the virtual file system sandbox that exposed arbitrary host files, including the credential-stuffed configuration that anchors enterprise partner integrations. Exploitation followed within days, CISA listed it April 30, and a chaotic trail of interim builds left customers arguing about version numbers mid-fire. This account covers the traversal-to-escape chain, the mainserv credential hunt, and the hard lessons of small-vendor emergency patching.

Continue ReadingCrushFTP VFS Sandbox Escape: Zero-Trust Patch Confusion in File Transfer
Read more about the article PuTTY ECDSA Nonce Bias: How 71 Signatures Exposed Your SSH Key

PuTTY ECDSA Nonce Bias: How 71 Signatures Exposed Your SSH Key

PuTTY’s April 2024 advisory for CVE-2024-31497 read like a physics problem: the terminal’s ECDSA implementation biased nonces on NIST P-521, so roughly 71 captured SSH signatures suffice for a lattice attack that recovers the private key. This piece explains the Hidden Number Problem math, why archived PCAP and DLP session capture retroactively weaponized years of traffic, the 0.81 deterministic-nonce fix, and the brutal rotation drill that made every P-521 key used through Pageant presumptively burned.

Continue ReadingPuTTY ECDSA Nonce Bias: How 71 Signatures Exposed Your SSH Key
Read more about the article PAN-OS GlobalProtect Zero-Day: CVE-2024-3400 Explained

PAN-OS GlobalProtect Zero-Day: CVE-2024-3400 Explained

On April 12, 2024, WatchTowr disclosed CVE-2024-3400 — a CVSS 10.0 pre-auth command injection in PAN-OS GlobalProtect that state-sponsored actors had exploited since late March by chaining a cookie-controlled file write into Tcl execution as root. This account walks the two-flaw exploit chain, the scramble after the 10.2.9-h1 hotfix, CISA’s KEV clock, config-hidden persistence that survived reboots, the mitigation-versus-remediation confusion, and why 2024 made appliances patch with server-grade urgency.

Continue ReadingPAN-OS GlobalProtect Zero-Day: CVE-2024-3400 Explained
Read more about the article AT&T 73M Leak: The 2019 Dataset That Resurfaced Free

AT&T 73M Leak: The 2019 Dataset That Resurfaced Free

March 2024’s 73-million-record AT&T leak was an old wound reopened: a 2019-era vendor-workspace dataset, shopped unsuccessfully in 2021, finally dumped free on a hacking forum with SSNs and account details intact. This account disentangles it from the concurrent Snowflake campaign, explains why free publication maximizes criminal utility, maps the 7.6 million passcode resets, and follows the extortion thread that later surfaced in DOJ filings.

Continue ReadingAT&T 73M Leak: The 2019 Dataset That Resurfaced Free
Read more about the article The XZ Utils Backdoor: Inside the Almost-Catastrophe

The XZ Utils Backdoor: Inside the Almost-Catastrophe

The most patient supply-chain attack ever caught — a two-year maintainer infiltration that planted an SSH backdoor into xz-utils release tarballs, discovered in March 2024 only because one engineer noticed 500 milliseconds of latency. This account traces the Jia Tan persona from helpful contributor to release engineer, the test-file obfuscation and build-stage injection, the systemd/sshd target chain, the near-miss that kept stable distros clean, and the trust-model reforms that rippled through open source.

Continue ReadingThe XZ Utils Backdoor: Inside the Almost-Catastrophe
Read more about the article LockBit Takedown: Operation Cronos and Its Awkward Aftermath

LockBit Takedown: Operation Cronos and Its Awkward Aftermath

February 2024’s Operation Cronos seized LockBit’s infrastructure across a dozen countries — and then the leaks showed how long the FBI had been inside. This account covers the covert access, the sting timing driven by UK hospital targeting, the servers and affiliate accounts taken down, the hurried rebrand to LockBit 4.1, the affiliate diaspora to RansomHub and Akira, and the awkward questions the takedown’s trolling raised about reading crime statistics.

Continue ReadingLockBit Takedown: Operation Cronos and Its Awkward Aftermath
Read more about the article JetBrains TeamCity Auth Bypass: Build Servers as Front Door

JetBrains TeamCity Auth Bypass: Build Servers as Front Door

March 2024’s CVE-2024-27198 let unauthenticated attackers mint admin accounts on self-hosted TeamCity CI servers, converting every connected build agent into attacker-controlled execution holding source, secrets and signing keys. This piece covers the alternate-path authentication bypass, the companion path traversal, the ransomware crews that queued within days, and the year’s hard-learned rule that build infrastructure deserves domain-controller-grade security.

Continue ReadingJetBrains TeamCity Auth Bypass: Build Servers as Front Door