Uber’s 2022 Hack: A Bought Password, a Flood of Pushes, and vSphere
An 18-year-old bought a contractor’s Uber password, bombarded them with MFA pushes until one was approved, then roamed to vSphere via hardcoded credentials.
Predatory Sparrow: The OT Hack That Melted Steel on Camera
Furnaces halted, footage released, workers warned. How a state-aligned group turned industrial sabotage into broadcast messaging.
PwnKit: The 12-Year Local Root in Every Linux
CVE-2021-4034 gave instant root on default Linux installs via pure logic flaw. Why setuid code still deserves emergency attention.
HermeticWiper: Cyber Arson on Invasion Eve
Hours before tanks rolled, a signed wiper shredded hundreds of Ukrainian networks. The anatomy of the first invasion-synced destructive campaign.
Twitch Leak: 125GB of Source Code and Payouts on 4chan
No malware, no zero-day — one exposed internal endpoint handed over Twitch’s entire codebase and three years of creator earnings.
Facebook 533M Leak: Old Scraped Data Never Stops Burning
A 2019 contact-import scrape of 533M users hit every phone number to profile, free-dumped in 2021 and still fueling vishing and SIM-swaps today. Why data age barely dents attacker value.
WD My Book Live Mass Wipe: The EOL IoT Disaster
Tens of thousands of abandoned Western Digital NAS drives got factory-reset by strangers through a decade-old unpatched flaw. The definitive end-of-life IoT case study.
Living Off Trusted Infrastructure: C2 via Legitimate Services
DragonForce’s Backdoor.Turn routes ransomware C2 through Microsoft Teams TURN relays using anonymous visitor tokens — LOTI, living off trusted infrastructure. Why network detection dies and what still works.
Western Digital’s My Cloud Outage: Vendor Risk for NAS
WD’s 2023 intrusion took My Cloud services offline mid-extortion claims, locking users out of their own files. Cloud-tethered storage lessons.
The 3CX Supply-Chain Attack: When Signed Updates Turn Against You
3CX’s signed desktop app shipped a trojan after its build pipeline fell to an upstream vendor compromise — the first documented double supply-chain attack.
GoDaddy’s Multi-Year cPanel Breach: 2.5 Years of Dwell
GoDaddy’s 2023 filing admitted intermittent intruder access since 2020, malware in cPanel servers, and email interception affecting ~6.95M customers.
ESXiArgs: The Ransomware Wave That EncryptEd Whole Estates
ESXiArgs hit thousands of unpatched VMware ESXi hosts via old OpenSLP bugs in February 2023. Hypervisor ransomware and recovery-script lessons.