Cyberattacks 2024

Snowflake-Related Arrests: UNC5537’s Kitchener Pinch

Post author:Prabhu Kalyan Samal
Post published: September 8, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

On October 30, 2024, Canadian authorities arrested a 26-year-old Kitchener, Ontario man on a US warrant connecting him to the Snowflake-account intrusions tracked by Mandiant as UNC5537 — the crew behind the Ticketmaster, Santander, and AT&T disclosures that dominated 2024’s data-theft calendar. The arrest, first reported in early November by Bloomberg identifying the suspect as Connor Riley Moucka, illuminated the infostealer-credential-to-cloud kill chain and the market for stolen data. This account reconstructs the campaign, the arrest, and the MFA lessons that outlast it.

Internet Archive Breach and DDoS: 31M Accounts, One Pop-Up

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

On October 9, 2024, visitors to the Internet Archive’s Wayback Machine were greeted by an injected JavaScript pop-up announcing the compromise of 31,081,179 user accounts — the HIBP-confirmed count of the organization’s authentication database, loaned from a September exposure of its Zendesk support portal. A concurrent DDoS attributed to SN_BlackMeta compounded the disruption; days later, archived XSS attempts confirmed the org’sJavaScript security debt. This account traces the initial access, the pop-up’s evidence chain, and the funding-and-fragility story of a library built on hope.

Sisense Breach: CI Credentials, AWS Keys and a CISA Advisory

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Security Supply Chain Security

On April 24, 2024, CISA and the FBI advised every Sisense customer to rotate credentials after attackers compromised the BI vendor’s development environment — and by week’s end, Sisense-issued AWS keys were circulating publicly. This piece reconstructs the five-day arc from detection to contained, explains why business-intelligence platforms are credential funnels that turn vendor CI/CD breaches into customer incidents, and extracts the third-party-risk doctrine the episode left behind for every embedded-analytics supply chain.

Squarespace Domain Hijackings: The 2024 GoDaddy Migration Aftermath

Post author:Prabhu Kalyan Samal
Post published: September 4, 2026
Post category:Cloud & Infrastructure Security Supply Chain Security

After Squarespace absorbed roughly 10 million domains from Google Domains in mid-2024, attackers discovered a seam: legacy Google-account login flows stopped being enforced, and formerly eNom-transferred .dev/.us domains could be taken over by re-registering then-unlinked accounts. From late June through July, crypto-draining hijacks of high-value domains — including Matomo founder trust abusing Squarespace lock states — left registry operators and site owners scrambling. This account traces the migration mechanics, the attack window, and the DNS tenure lessons.

TfL 2024: A 17-Year-Old, a Social Engineer’s Approach and Oyster Chaos

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

On September 5, 2024, Transport for London detected an intrusion begun days earlier through social engineering of staff — and within a week a 17-year-old was arrested, then charged under the Computer Misuse Act, for a breach that exposed contact details and the bank details of roughly 3,000 Oyster refund customers. This account reconstructs the phishing entry, the lateral movement, the containment that took status boards and the refund portal offline, the NCSC-NCA response, and the municipal-security lessons that outlasted the headlines.

PuTTY ECDSA Nonce Bias: How 71 Signatures Exposed Your SSH Key

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Cryptography & PKI Security

PuTTY’s April 2024 advisory for CVE-2024-31497 read like a physics problem: the terminal’s ECDSA implementation biased nonces on NIST P-521, so roughly 71 captured SSH signatures suffice for a lattice attack that recovers the private key. This piece explains the Hidden Number Problem math, why archived PCAP and DLP session capture retroactively weaponized years of traffic, the 0.81 deterministic-nonce fix, and the brutal rotation drill that made every P-521 key used through Pageant presumptively burned.

The XZ Utils Backdoor: Inside the Almost-Catastrophe

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Security Supply Chain Security

The most patient supply-chain attack ever caught — a two-year maintainer infiltration that planted an SSH backdoor into xz-utils release tarballs, discovered in March 2024 only because one engineer noticed 500 milliseconds of latency. This account traces the Jia Tan persona from helpful contributor to release engineer, the test-file obfuscation and build-stage injection, the systemd/sshd target chain, the near-miss that kept stable distros clean, and the trust-model reforms that rippled through open source.