HermeticWiper: Cyber Arson on Invasion Eve
Hours before tanks rolled, a signed wiper shredded hundreds of Ukrainian networks. The anatomy of the first invasion-synced destructive campaign.
DST Root CA X3 Expiry: The Scheduled Outage That Mostly Wasn’t
Five years of notice, one expired root, and a clever cross-sign that kept old Android trusting Let’s Encrypt. The rehearsal for every future trust migration.
Twitch Leak: 125GB of Source Code and Payouts on 4chan
No malware, no zero-day — one exposed internal endpoint handed over Twitch’s entire codebase and three years of creator earnings.
Facebook 533M Leak: Old Scraped Data Never Stops Burning
A 2019 contact-import scrape of 533M users hit every phone number to profile, free-dumped in 2021 and still fueling vishing and SIM-swaps today. Why data age barely dents attacker value.
WD My Book Live Mass Wipe: The EOL IoT Disaster
Tens of thousands of abandoned Western Digital NAS drives got factory-reset by strangers through a decade-old unpatched flaw. The definitive end-of-life IoT case study.
The Ship Is a Floating OT Network: Maritime Cyber Rules Got Teeth in 2024
Since January 2024, ships manage cyber risk under IMO-derived requirements enforced by flag and port-state control, IACS E26 and E27 give class societies assessment criteria, and the US Coast Guard can detain deficient vessels. Bridge, cargo, propulsion, SATCOM and crew IT share one hull: treat the vessel as an OT estate.
NIS2 shield checklist inside 12 star circle
NIS2 Is Not Just for Banks: The Compliance Clock
Food plants, logistics firms, waste management, research labs: 18 sectors are in scope, plus everyone their covered customers drag in via contracts. The duties read like an incident-readiness program — 24-hour early warning, 72-hour notification, personal accountability for executives — and the basics were overdue anyway.
Living Off Trusted Infrastructure: C2 via Legitimate Services
DragonForce’s Backdoor.Turn routes ransomware C2 through Microsoft Teams TURN relays using anonymous visitor tokens — LOTI, living off trusted infrastructure. Why network detection dies and what still works.
Ensuring Robust Security in Login and Registration Systems
Comprehensive guide to securing login and registration systems. Covers authentication vulnerabilities, brute-force protection, session management, CAPTCHA implementation, and security best practices.
Barracuda ESG Hack: When Patching Isn’t Enough
CVE-2023-2868 gave pre-auth RCE in Barracuda’s email gateways via spreadsheet parsing, exploited since October 2022. The final verdict: replace every appliance. Remediation doctrine lessons.
Meta’s €1.2B GDPR Fine: Transfers vs. Reality
Ireland’s DPC fined Meta €1.2B over EU-US transfers that Schrems II had already doomed — the largest GDPR fine ever, ordering suspension and deletion. Transfer-governance lessons for security teams.
ASUS Routers Bricked by Their Own Update Channel
A server-side fault in ASUS’s firmware-update mechanism crashed routers worldwide, requiring manual recovery — a global outage delivered through the trusted update path, no attacker required.
- Go to the previous page
- 1
- …
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- …
- 31
- Go to the next page