phishing – Page 2

Hmmnm cover v2 — SECURITY

When Hackers Hunted the WHO: Cyberattacks in a Pandemic’s First Weeks

Post author:Hmmnm
Post published:March 24, 2020
Post category:Identity & Phishing Security

On 24 March 2020, Reuters reported that hackers had stood up a near-identical malicious imitation of the World Health Organization's internal email portal, infrastructure aimed at stealing passwords from staffers coordinating the global pandemic response. The same reporting documented that around 450 active WHO email addresses and passwords, plus thousands more belonging to people working on the COVID-19 response, had been leaked online. It was not an isolated incident but part of a documented surge in targeting of health bodies that spring. This piece reconstructs the verified incidents of March 2020 and the wider lesson that crisis response organizations are priority intelligence targets.

Hmmnm cover v2 — SECURITY

The FBI’s COVID-19 Warning: IC3 and the Scam Surge of March 2020

Post author:Hmmnm
Post published:March 20, 2020
Post category:Identity & Phishing Security

On 20 March 2020, the FBI's Internet Crime Complaint Center published a public service announcement warning that cyber criminals were exploiting the COVID-19 pandemic at scale: phishing lures referencing stimulus payments and fake cures, malicious apps, and infrastructure spoofing health authorities. It was one node in a broader wave of official guidance that spring, with CISA and the UK's NCSC issuing joint advice on pandemic-era remote work and video conferencing security, and IC3's later reporting would show complaint volumes surging through 2020. This retrospective explains what the warning said, what the threat landscape actually looked like that spring, and how a global crisis became an attack-surface multiplier.

Hmmnm cover v2 — SECURITY

Ransomware at a Gas Compression Facility: CISA’s OT Alert

Post author:Hmmnm
Post published:February 20, 2020
Post category:Cloud & Infrastructure Ransomware & Malware Security

On 20 February 2020, CISA published AA20-030A, a joint advisory describing how ransomware had disrupted a natural gas compression facility: a phishing link let commodity ransomware spread from IT into the OT network, encrypting data historians and polling servers, severing HMI visibility, and leaving operators blind to real-time pressure and flow data for two days. The advisory became a reference model for oil and gas asset owners because it mapped, step by step, how a single email chained into loss of operational visibility without directly controlling pipeline equipment. This retrospective walks through the kill chain, the defensive gaps, and the guidance that followed.