APT29

APT29 Inside TeamViewer: 2024’s Calmest, Most Instructive Breach

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

On June 28, 2024, TeamViewer disclosed that a state-sponsored actor — widely reported as Russia’s APT29 — had breached its corporate IT network through a standard employee’s credentials, and that the remote-access product itself, and every customer, stayed untouched. This account reconstructs the hours-to-containment timeline, explains why corporate/product segmentation carried the day, places the intrusion in Cozy Bear’s patient espionage season, and draws the anti-SolarWinds comparison that made this 2024’s most instructive breach.

Nobelium’s Password Spray: The Channel Becomes the Supply Chain

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Identity & Phishing Security

The SolarWinds actor returned with no implant at all — sprayed passwords, replayed tokens, and delegated partner admin rights over 609 channel companies.

SolarWinds SUNBURST: Inside the Supply-Chain Attack That Rewrote Security

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Emerging Tech & Architecture Security Supply Chain Security

The full incident file on the SolarWinds SUNBURST supply-chain attack: how SVR-linked actors compromised the Orion build pipeline, trojanized signed updates reaching 18,000 customers, hand-picked under 100 targets including nine US federal agencies, and forged SAML tokens to persist. Includes the technical anatomy, timeline, impact numbers, and the build-pipeline hardening lessons that still define defender programs in 2026.