https://syscfg.sh Independent security research: incident history, threat actor operations, underground community culture, and technical deep-dives. en-us Thu, 01 Oct 2026 00:00:00 GMT syscfg syscfg 60 https://syscfg.sh/research/uefi-firmware-persistence-lojax-cosmicstrand-blacklotus https://syscfg.sh/research/uefi-firmware-persistence-lojax-cosmicstrand-blacklotus LoJax in 2018, CosmicStrand in 2022, BlackLotus in 2023. Each one survives an OS reinstall, a disk wipe, and a complete CrowdStrike scan - because none of them live where those tools look. A technical walkthrough of all three cases, what they do to the boot chain, and the three tools that can actually find them: CHIPSEC for SPI flash inspection, UEFITool for firmware image analysis, and TPM PCR attestation for boot integrity measurement. Pairs with the DDRop article as a hardware-trust cluster. Thu, 01 Oct 2026 00:00:00 GMT syscfg uefi firmware rootkit bootkit lojax cosmicstrand blacklotus apt28 secure-boot cve-2022-21894 chipsec uefi-tool tpm pcr-attestation incident-response detection-engineering byovd spi-flash https://syscfg.sh/research/going-dark-hardware-surveillance https://syscfg.sh/research/going-dark-hardware-surveillance The companion to the Crypto Wars piece: given that the cypherpunks won strong encryption, what does using it in hardware actually look like - and what does each piece of kit not do? A field guide with the marketing removed, built around the only question that matters: secure against whom? Hardware keys, GrapheneOS, Faraday bags, EFF's Rayhunter IMSI-catcher detector, and the metadata wall every layer hits. Every measure states its limits. Includes an interactive threat-model picker. Mon, 28 Sep 2026 00:00:00 GMT syscfg surveillance privacy opsec threat-model grapheneos fido2 yubikey faraday-bag imsi-catcher stingray rayhunter eff metadata signal hardware https://syscfg.sh/research/crypto-wars-cypherpunks https://syscfg.sh/research/crypto-wars-cypherpunks For most of the 1990s a strong encryption program was legally a munition, and exporting it was arms trafficking. The people who broke that framing were a mailing list. This is the story of the cypherpunks and the Crypto Wars: Tim May's manifesto, Zimmermann publishing PGP's source as a book to make its munition status absurd, Matt Blaze gutting the Clipper chip, and the Bernstein case that held code is speech - before the ruling was quietly withdrawn. Includes an interactive test of what 1990s export law actually classed as a weapon. Sun, 27 Sep 2026 00:00:00 GMT syscfg cypherpunks crypto-wars pgp phil-zimmermann clipper-chip matt-blaze bernstein tim-may eric-hughes itar encryption first-amendment surveillance privacy https://syscfg.sh/research/shinyhunters-peoplesoft-cve-2026-35273 https://syscfg.sh/research/shinyhunters-peoplesoft-cve-2026-35273 ShinyHunters exploited an unauthenticated RCE in Oracle PeopleSoft against 100-plus organisations, two thirds of them universities, and published the data one day before Oracle shipped a patch. Post-exploitation ran almost entirely on legitimate software: MeshCentral disguised as an Azure service, a bash script spraying SSH credentials, zstd for exfiltration. In September they defaced the FBI's job portal and claimed 2 TB via a second PeopleSoft zero-day - and demanded no money, only that the FBI delete an advisory warning victims that this group frequently claims to hold data it does not have. An analysis of the documented campaign, the unverified claim, and an extortion business defending its reputation. Thu, 24 Sep 2026 00:00:00 GMT syscfg shinyhunters unc6240 cve-2026-35273 oracle-peoplesoft ssrf rce meshcentral sshpass lateral-movement fbi extortion defacement instructure canvas education-sector zstd kev detection-engineering https://syscfg.sh/research/shinyhunters-oauth-saas-supply-chain https://syscfg.sh/research/shinyhunters-oauth-saas-supply-chain Three times in ten months, ShinyHunters and associated actors took data out of hundreds of Salesforce tenants without signing in to any of them. No password guessed, no MFA answered, no sign-in alert raised at any victim. The queries came through connected applications those organisations had approved. An analysis of why an approved OAuth grant is the one credential in most environments that nobody owns, nobody reviews and nothing watches - with an interactive comparison of which controls actually see each route in. Tue, 22 Sep 2026 00:00:00 GMT syscfg shinyhunters oauth saas supply-chain salesforce salesloft-drift gainsight klue unc6395 storm-3138 identity token-theft detection-engineering https://syscfg.sh/research/bumblebee-adaptixc2-akira https://syscfg.sh/research/bumblebee-adaptixc2-akira An IT administrator searched Bing for ManageEngine OpManager and installed a trojanized MSI that also installed the real software. Forty-four hours later the domain was encrypted and 77 GB was gone. Almost nothing in the chain was exotic: the credential theft used wbadmin, the persistence used RustDesk, and the discovery used four built-in Windows commands. An analysis of The DFIR Report's June 2026 writeup, with the infrastructure comparison that suggests the delivery chain is a service sold to more than one actor. Sat, 19 Sep 2026 00:00:00 GMT syscfg akira bumblebee adaptixc2 ransomware seo-poisoning dll-sideloading living-off-the-land wbadmin ntds-dit rustdesk lsassy veeam dfir https://syscfg.sh/research/ddrop-ddr5-interposer-confidential-computing https://syscfg.sh/research/ddrop-ddr5-interposer-confidential-computing A $159 board sits between a server's CPU and its DDR5 memory, passes every boot integrity check, then starts silently discarding writes by injecting parity errors. The encryption still works. The attestation still verifies. The CPU reads cryptographically valid data that is simply out of date - because memory encryption protects contents without recording which version is newest. Forged TDX attestation reports, plaintext page copying on SEV-SNP, and the detection channel that falls out for free: every dropped write raises a correctable ECC error nobody is watching. Fri, 18 Sep 2026 00:00:00 GMT syscfg ddrop badram battering-ram confidential-computing intel-tdx sgx amd-sev-snp ddr5 interposer hardware-attacks attestation memory-encryption ecc tee https://syscfg.sh/research/pivotc2-fortigate-cve-2025-25249 https://syscfg.sh/research/pivotc2-fortigate-cve-2025-25249 NVD scored CVE-2025-25249 at 9.8. Fortinet, the CNA that assigned it, scored it 8.1. The whole gap is one metric - attack complexity - and it decides whether your process treats a heap overflow in an internet-facing FortiGate daemon as an emergency or as routine. By September 2026 SOCRadar had counted more than 30,000 targeted addresses and 178 confirmed PivotC2 implants, which is the empirical answer. Includes a working CVSS 3.1 calculator loaded with both vectors, and what the implant actually takes off the device. Thu, 17 Sep 2026 00:00:00 GMT syscfg fortigate fortios cve-2025-25249 pivotc2 cvss capwap cw-acd edge-devices vulnerability-management tor obfs4 socradar patch-management https://syscfg.sh/research/tuktuk-etherrat-gentlemen-saas-c2 https://syscfg.sh/research/tuktuk-etherrat-gentlemen-saas-c2 An intrusion ending in domain-wide Gentlemen ransomware, where the command and control ran over ClickHouse, Supabase, Ably, Dropbox, GitHub Issues and an Arweave dead drop, with configuration read off the Ethereum blockchain. Every channel is a product a company might be paying for, so blocking the C2 means blocking your own vendors. Includes what the researchers actually found behind the widely repeated claim that the framework was AI-generated, and the four-lesson internal curriculum the group wrote for hunting vulnerable drivers. Wed, 16 Sep 2026 00:00:00 GMT syscfg tuktuk etherrat gentlemen-ransomware etherhiding ethereum clickhouse supabase ably arweave byovd edr-evasion rclone gpo kerberoasting dfir https://syscfg.sh/research/targeted-ssh-recon-campaign https://syscfg.sh/research/targeted-ssh-recon-campaign Two usernames exist in this honeypot's logs that appear in no credential wordlist: syscfg and feed, the site's handle and its API subdomain. In 1,251,496 events, exactly five addresses ever tried them - each firing one 40 to 88 minute burst on a single day, paced at one attempt every nine seconds, spread across a month. Three of the five trace to one ISP accounting for 0.21% of observed sources. The reconnaissance was targeted; the 147-password wordlist behind it was entirely off the shelf. Tue, 15 Sep 2026 00:00:00 GMT syscfg honeypot cowrie ssh targeted-attack credential-attack reconnaissance opsec threat-intelligence ioc original-research https://syscfg.sh/research/ssh-botnet-rsa-key-fingerprint https://syscfg.sh/research/ssh-botnet-rsa-key-fingerprint A single RSA public key was implanted 632 times from 511 distinct source IPs across 30 days of honeypot logs. The delivery command was byte-for-byte identical every time. The source addresses span dozens of countries and ASNs, making blocklist-based defense useless - but the key never changes, because rotating it would orphan every host already backdoored. An analysis of what the shared key reveals about botnet topology, the chattr sequence that preceded every implant, and why a public key is a stronger hunt IOC than any IP address in this dataset. Mon, 14 Sep 2026 00:00:00 GMT syscfg honeypot cowrie ssh botnet rsa ioc threat-hunting authorized-keys chattr botnet-fingerprint credential-spray original-research threat-intelligence https://syscfg.sh/research/build-step-supply-chain-chaindrop-xcsset https://syscfg.sh/research/build-step-supply-chain-chaindrop-xcsset An npm worm in 400+ packages and a macOS infostealer hiding in Xcode projects, four months apart, sharing no code and probably no operator. Both attack the same thing: the moment a developer turns source into software. ChainDrop reads CI secrets out of process memory and publishes genuine SLSA provenance through Sigstore for its own malicious artifact. XCSSET recompiles its loader eight times a day and ages its domains for months. Neither is a bypass - both are security controls working exactly as specified on an input nobody specified for. Sun, 13 Sep 2026 00:00:00 GMT syscfg supply-chain chaindrop npm xcsset macos xcode ci-cd sigstore slsa provenance ethereum etherhiding bun chrome-cdp credential-theft https://syscfg.sh/research/mdrfckr-hassh-ioc-decay https://syscfg.sh/research/mdrfckr-hassh-ioc-decay A HASSH fingerprint published in 2022 for the mdrfckr SSH botnet matched zero of 632 implants in a 2026 honeypot corpus. The campaign now runs libssh 0.9.6, 0.11.1 and 0.12.0, and its newest builds negotiate post-quantum key exchange. The implanted RSA key - 2048-bit, public exponent 37 - has not changed a byte in four years, because rotating it would orphan every host already backdoored. An independent test of someone else's indicator, and what it says about ranking IOCs by what they cost the adversary to change. Sat, 12 Sep 2026 00:00:00 GMT syscfg hassh ioc-decay mdrfckr dota ssh cowrie honeypot botnet libssh detection-engineering post-quantum https://syscfg.sh/research/ssh-honeypot-31-days https://syscfg.sh/research/ssh-honeypot-31-days A Cowrie SSH honeypot on a Helsinki VPS logged 1,251,496 events across 134,060 sessions in 31 days. Analysis of the raw JSON logs reveals five coordinated addresses whose username lists contained this server's own identity, a single RSA backdoor key implanted 632 times from 511 distinct IPs via a byte-identical command, active Solana validator hunting, three concurrent Mirai variants, and named multi-architecture malware campaigns. Every number sourced directly from the Cowrie log corpus. Fri, 11 Sep 2026 00:00:00 GMT syscfg honeypot cowrie ssh mitre botnet mirai credential-spray threat-intelligence malware-analysis ioc https://syscfg.sh/research/echoleak-cve-2025-32711 https://syscfg.sh/research/echoleak-cve-2025-32711 CVE-2025-32711 let an attacker email a target once, never interact again, and have Microsoft 365 Copilot exfiltrate that person's confidential data when they asked it to summarise their inbox. Microsoft had four separate defences in place - an injection classifier, link redaction, a click requirement and a Content Security Policy - and the exploit walked through all four using alternative Markdown syntax and Microsoft's own Teams URL-preview endpoint as the proxy. The pattern is more instructive than the trick: every control filtered a representation, none constrained the capability. Sat, 05 Sep 2026 00:00:00 GMT syscfg echoleak cve-2025-32711 prompt-injection microsoft-365-copilot llm-security ai-security rag data-exfiltration csp-bypass coordinated-disclosure https://syscfg.sh/research/wannacry-eternalblue https://syscfg.sh/research/wannacry-eternalblue In May 2017, a ransomware worm called WannaCry spread to 200,000 machines across 150 countries in three days. It used EternalBlue - a cyberweapon the NSA had developed and stockpiled for years before it was stolen and leaked. A full technical and historical breakdown, with an interactive recreation of the ransom screen. Sat, 08 Aug 2026 00:00:00 GMT syscfg wannacry eternalblue ransomware nsa shadowbrokers smb lazarus https://syscfg.sh/research/silk-road-dpr-opsec https://syscfg.sh/research/silk-road-dpr-opsec Ross Ulbricht built the internet's first major dark web marketplace, moved $1.2 billion in contraband, and evaded the FBI for two years - until a single post on Stack Overflow under his real name connected everything. A detailed reconstruction of the investigation, the mistakes, and the arrest in a San Francisco library. Tue, 04 Aug 2026 00:00:00 GMT syscfg silk-road ross-ulbricht dpr opsec darknet tor bitcoin https://syscfg.sh/research/sim-swapping-og-scene https://syscfg.sh/research/sim-swapping-og-scene It started with stealing Instagram handles. By 2020, the same community of teenagers had compromised Twitter's internal tools, hijacked 130 celebrity accounts, and stolen hundreds of millions in cryptocurrency. A full history of the SIM swapping scene - from OGUsers to PlugwalkJoe to the most public hack in social media history. Mon, 03 Aug 2026 00:00:00 GMT syscfg sim-swapping ogusers cryptocurrency social-engineering telecom twitter-hack https://syscfg.sh/research/operation-bayonet https://syscfg.sh/research/operation-bayonet In 2017, law enforcement didn't just take down the two largest dark web markets - they secretly ran one of them for a month first. The story of how Alexandre Cazes lost AlphaBay to a personal hotmail address, how Dutch police quietly seized Hansa and watched 10,000 users incriminate themselves, and why this was the most methodical takedown the dark web has ever seen. Fri, 31 Jul 2026 00:00:00 GMT syscfg alphabay hansa darknet operation-bayonet alexandre-cazes dea fbi opsec https://syscfg.sh/research/opsec-hall-of-shame https://syscfg.sh/research/opsec-hall-of-shame A documented catalogue of operational security failures - from LulzSec's Sabu logging into IRC without a proxy once, to Pompompurin accidentally typing his own Gmail address in a public post, to the darknet admin who sent support emails from his personal hotmail. Every case study follows the same arc: years of careful tradecraft, undone by a single moment of carelessness. Wed, 29 Jul 2026 00:00:00 GMT syscfg opsec arrested mistakes sabu pompompurin intelbroker cybercrime https://syscfg.sh/research/lulzsec-50-days https://syscfg.sh/research/lulzsec-50-days For 50 days in 2011, LulzSec humiliated some of the most powerful institutions on the internet - the CIA, the FBI's affiliate site, Sony, HBGary Federal - then dissolved. What the public didn't know was that their leader, Sabu, had already been caught and flipped. A reconstruction of the most chaotic hacking spree of the era and how a single unmasked IRC session ended it. Sat, 25 Jul 2026 00:00:00 GMT syscfg lulzsec anonymous sabu hbgary sony antisec fbi-informant https://syscfg.sh/research/the-com-scattered-spider https://syscfg.sh/research/the-com-scattered-spider From 4chan raids and IRC to OGUsers and Discord, a generation of English-speaking teenagers built a cybercrime ecosystem that took down Microsoft, Nvidia, Uber, MGM Resorts, and Caesars Entertainment. An inside look at 'The COM' - the loose network of drama-fuelled young hackers whose preferred attack vector is still a phone call. Tue, 21 Jul 2026 00:00:00 GMT syscfg scattered-spider lapsus the-com mgm caesars social-engineering teenagers https://syscfg.sh/research/fappening-anatomy https://syscfg.sh/research/fappening-anatomy One man, working alone for almost two years, built a custom phishing kit that mirrored Apple and Google login pages, sent targeted emails to celebrities, and quietly downloaded hundreds of iCloud backups. The investigation into the 2014 iCloud leak reveals how methodical, patient, and low-tech the most high-profile hack of that decade actually was. Wed, 15 Jul 2026 00:00:00 GMT syscfg phishing icloud celebrity social-engineering opsec ryan-collins https://syscfg.sh/research/shadowcrew-origins https://syscfg.sh/research/shadowcrew-origins Before BreachForums, before Nulled, before every combolist forum that followed - there was ShadowCrew. Founded in 2002 by Brett Johnson (later called 'The Original Internet Godfather'), it pioneered the structure, the reputation system, and the vendor economy that every dark web marketplace since has copied. In 2004, the Secret Service arrested 33 people in six countries in six hours. Sat, 11 Jul 2026 00:00:00 GMT syscfg shadowcrew carding darknet brett-johnson secret-service cybercrime-history https://syscfg.sh/research/stuxnet https://syscfg.sh/research/stuxnet Operation Olympic Games, joint NSA and Israeli Unit 8200 project, deployed the most sophisticated cyberweapon ever built against Iran's Natanz enrichment facility. Stuxnet used four zero-days, a Siemens PLC rootkit, and a SCADA spoofing layer to silently destroy 1,000 centrifuges over 18 months while operators watched screens showing normal readings. Fri, 10 Jul 2026 00:00:00 GMT syscfg stuxnet iran natanz siemens plc zero-day nsa unit-8200 olympic-games https://syscfg.sh/research/mirai-botnet https://syscfg.sh/research/mirai-botnet In October 2016, a botnet of 600,000 compromised IP cameras and home routers launched the largest DDoS attack in history, taking down Twitter, Netflix, Reddit, and Spotify via a single DNS provider. The authors were three college students who built it to win arguments about Minecraft server hosting. Thu, 09 Jul 2026 00:00:00 GMT syscfg mirai botnet iot ddos dyn paras-jha default-credentials telnet https://syscfg.sh/research/notpetya https://syscfg.sh/research/notpetya On June 27, 2017, Russian military intelligence deployed a cyberweapon through a Ukrainian accounting software update that destroyed $10 billion worth of computer systems globally. NotPetya was not ransomware - the ransom demand was misdirection. The files could not be recovered. A reconstruction of the most destructive cyberattack in history. Tue, 07 Jul 2026 00:00:00 GMT syscfg notpetya sandworm gru russia ukraine supply-chain eternalblue mimikatz wiper maersk https://syscfg.sh/research/log4shell https://syscfg.sh/research/log4shell CVE-2021-44228 received the maximum CVSS score of 10.0 and affected virtually every Java application on the internet. The vulnerability: Log4j evaluated JNDI lookups embedded in log messages, allowing attackers to trigger remote code execution by sending a single string to any logged field. Nation-state actors and ransomware groups were exploiting it within 24 hours of disclosure. Fri, 03 Jul 2026 00:00:00 GMT syscfg log4shell log4j cve-2021-44228 jndi rce java apache supply-chain https://syscfg.sh/research/colonial-pipeline https://syscfg.sh/research/colonial-pipeline DarkSide ransomware group accessed Colonial Pipeline's network via a single leaked VPN password with no MFA. The resulting six-day shutdown of the US's largest fuel pipeline caused a national emergency, gas shortages across the East Coast, and a $4.4M ransom. The FBI later recovered $2.3M by seizing DarkSide's wallet private key. Mon, 29 Jun 2026 00:00:00 GMT syscfg colonial-pipeline darkside ransomware raas critical-infrastructure ics mfa vpn https://syscfg.sh/research/dns-security-attacks https://syscfg.sh/research/dns-security-attacks DNS was designed in 1983 before security was a requirement. The Kaminsky attack in 2008 demonstrated cache poisoning at scale. Iranian and other state actors have hijacked government domains through registrar compromise and BGP redirection. DNS over HTTPS encrypts queries for privacy but breaks enterprise security monitoring. A comprehensive look at DNS's structural security failures and the incremental fixes that haven't quite solved them. Thu, 25 Jun 2026 00:00:00 GMT syscfg dns dnssec cache-poisoning kaminsky doh dns-hijacking sea-turtle dnspionage registrar-attack https://syscfg.sh/research/package-manager-supply-chain https://syscfg.sh/research/package-manager-supply-chain From the left-pad incident that brought down thousands of builds to the event-stream Bitcoin theft targeting Copay, the open source package ecosystem has become a primary attack surface. Typosquatting, dependency confusion, and maintainer account takeover campaigns compromise millions of developer machines daily. The xz-utils backdoor proved even trusted packages with years of history aren't safe. The scale problem has no clean solution. Sun, 21 Jun 2026 00:00:00 GMT syscfg npm pypi supply-chain typosquatting dependency-confusion event-stream left-pad slsa package-manager https://syscfg.sh/research/phineas-fisher-hacking-team https://syscfg.sh/research/phineas-fisher-hacking-team In 2015, a lone operator known as Phineas Fisher breached Hacking Team and released 400GB of internal data - source code, customer lists, zero-days, and communications that exposed the surveillance company's sales to governments under arms embargoes. They then published a detailed guide explaining exactly how they did it. The third major breach in a pattern of targeted attacks against commercial spyware vendors, conducted as explicit political direct action. Thu, 18 Jun 2026 00:00:00 GMT syscfg phineas-fisher hacking-team finfisher gamma-group hacktivism commercial-spyware flash-zero-day 400gb-dump https://syscfg.sh/research/crypto-exchange-hacks https://syscfg.sh/research/crypto-exchange-hacks From Mt. Gox's 850,000 Bitcoin in 2014 to the $1.5B Bybit theft in 2025, cryptocurrency exchanges have lost billions in recurring predictable patterns: hot wallet compromises, smart contract exploits, and supply chain attacks on key management infrastructure. The irreversibility of cryptocurrency transactions means every failure is permanent. A comprehensive history of the largest thefts and the structural vulnerabilities that made them possible. Mon, 15 Jun 2026 00:00:00 GMT syscfg mt-gox bitfinex binance ronin bybit lazarus hot-wallet transaction-malleability defi bridge-hack https://syscfg.sh/research/cuckoos-egg-clifford-stoll https://syscfg.sh/research/cuckoos-egg-clifford-stoll In 1986, Clifford Stoll was tracking a 75-cent accounting discrepancy at Lawrence Berkeley Lab when he discovered a West German hacker systematically raiding US military computers on behalf of the KGB. His ten-month investigation - conducted solo with no legal framework, no interagency coordination, and tools he built from scratch - invented honeypots, intrusion detection, and cyber counterintelligence before those words existed. Fri, 12 Jun 2026 00:00:00 GMT syscfg cuckoos-egg clifford-stoll kGB markus-hess ARPANET honeypot incident-response cold-war berkeley https://syscfg.sh/research/juniper-backdoor-dual-ec https://syscfg.sh/research/juniper-backdoor-dual-ec In 2015, Juniper Networks discovered unauthorized code in its VPN firmware that had been present since 2012 - a modified Dual EC DRBG constant that could decrypt VPN traffic, and a hardcoded admin password. Investigation revealed the modification appeared to repurpose the NSA's own cryptographic backdoor mechanism, rekeyed to a different actor's trap door. The most concrete real-world demonstration that 'nobody but us' vulnerabilities don't stay that way. Sun, 07 Jun 2026 00:00:00 GMT syscfg juniper dual-ec-drbg nsa backdoor screenos vpn nobus cryptographic-weakness china https://syscfg.sh/research/commercial-spyware-industry https://syscfg.sh/research/commercial-spyware-industry There is a legal industry that sells silent device compromise tools to governments, marketed as 'lawful intercept' for law enforcement. FinFisher, Hacking Team's RCS, and NSO Group's Pegasus have all been documented targeting journalists, lawyers, dissidents, and opposition politicians alongside criminals. The Hacking Team breach in 2015 exposed the gap between stated vetting and actual practice. Pegasus used zero-click exploits to compromise iPhones with no user interaction. Tue, 02 Jun 2026 00:00:00 GMT syscfg pegasus nso-group finfisher hacking-team commercial-spyware citizen-lab zero-click lawful-intercept surveillance https://syscfg.sh/research/gameover-zeus-bogachev https://syscfg.sh/research/gameover-zeus-bogachev Evgeniy Bogachev's GameOver Zeus infected over 500,000 machines with a peer-to-peer banking trojan that stole $100M+ and delivered the first major ransomware campaign - CryptoLocker - at scale. Operation Tovar disrupted the network in 2014. Bogachev was indicted and the FBI offered a $3M reward. He lives openly on the Russian Black Sea coast. Evidence suggests his infrastructure was simultaneously used for Russian intelligence collection on Ukraine. Sun, 31 May 2026 00:00:00 GMT syscfg gameover-zeus bogachev zeus cryptolocker p2p-botnet banking-trojan russia operation-tovar fbi-reward https://syscfg.sh/research/yahoo-data-breaches https://syscfg.sh/research/yahoo-data-breaches Yahoo suffered two separate breaches - 500 million accounts in 2014, 3 billion in 2013 - and disclosed both during its acquisition by Verizon. Russian FSB officers and criminal associates were indicted. The delayed disclosure cost Yahoo $350M in its acquisition price and led to the first SEC enforcement action against a public company for failing to timely disclose a cybersecurity incident to investors. The credential data is still in use a decade later. Thu, 28 May 2026 00:00:00 GMT syscfg yahoo data-breach fsb russia verizon md5 credential-stuffing sec m&a forged-cookies https://syscfg.sh/research/tor-dark-web-history https://syscfg.sh/research/tor-dark-web-history Tor was designed by the US Navy to anonymize government communications - and released publicly because anonymity networks only work with cover traffic. From Naval Research Laboratory to State Department funding to the backbone of global dark web marketplaces, the history of onion routing tracks the internet's parallel economy. How hidden services work, how they were deanonymized, and why it was usually OPSEC failure rather than cryptographic breaks that brought them down. Mon, 25 May 2026 00:00:00 GMT syscfg tor dark-web onion-routing hidden-services silk-road alphaby hansa operation-onymous blockchain-analysis https://syscfg.sh/research/kaseya-revil-ransomware https://syscfg.sh/research/kaseya-revil-ransomware On July 2, 2021, REvil exploited authentication bypass vulnerabilities in Kaseya VSA - software used by managed service providers to remotely manage client computers - and deployed ransomware through the platform to 1,500 businesses across 17 countries. Coop supermarkets closed 800 stores in Sweden. The FBI held a decryptor for three weeks while conducting operations against REvil. Yaroslav Vasinskyi was later sentenced to 13 years. Sat, 23 May 2026 00:00:00 GMT syscfg kaseya revil ransomware msp supply-chain cve-2021-30116 vasinskyi sweden fbi-decryptor https://syscfg.sh/research/mgm-caesars-scattered-spider https://syscfg.sh/research/mgm-caesars-scattered-spider In September 2023, Scattered Spider compromised both MGM Resorts and Caesars Entertainment using help desk vishing attacks. Caesars paid $15M and kept operating. MGM refused to pay, took systems offline, and lost $100M in disruption as slot machines went dark across Las Vegas. The attacks illustrated the ransomware affiliate model, the English-speaking COM underground's growing sophistication, and the impossible calculus of ransom payment decisions. Mon, 18 May 2026 00:00:00 GMT syscfg scattered-spider mgm caesars alphv blackcat ransomware vishing help-desk okta the-com https://syscfg.sh/research/twitter-2020-hack https://syscfg.sh/research/twitter-2020-hack On July 15, 2020, a 17-year-old in Tampa, Florida used vishing to convince Twitter employees to hand over internal admin tool credentials, then took over 130 verified accounts including Barack Obama, Joe Biden, Elon Musk, Bill Gates, and Apple. The subsequent Bitcoin scam netted $120,000. What the attackers had access to but chose not to use - private direct messages of every compromised account - was considerably more alarming. Sat, 16 May 2026 00:00:00 GMT syscfg twitter vishing social-engineering bitcoin-scam graham-clark the-com admin-tools ogusers https://syscfg.sh/research/rsa-securid-breach https://syscfg.sh/research/rsa-securid-breach In March 2011, Chinese state-sponsored attackers compromised RSA Security via a phishing email with a Flash zero-day, and stole the seed values underlying 40 million SecurID tokens used by governments and defense contractors worldwide. Two months later, cloned tokens were used to attack Lockheed Martin. The breach established the template for supply chain attacks on security infrastructure itself - and accelerated the industry away from shared-secret authentication. Wed, 13 May 2026 00:00:00 GMT syscfg rsa securid two-factor seed-values lockheed-martin poison-ivy apt china supply-chain https://syscfg.sh/research/bangladesh-bank-swift-heist https://syscfg.sh/research/bangladesh-bank-swift-heist On February 4, 2016, North Korea's Lazarus Group used access to Bangladesh Bank's SWIFT terminals to submit $951 million in fraudulent transfer requests to the Federal Reserve Bank of New York. $81 million reached accounts in Manila and disappeared into the Philippine casino industry - which was legally exempt from anti-money-laundering requirements. The largest cyber heist in history exposed the systemic vulnerability of a global financial network where trust was not conditional on security standards. Sun, 10 May 2026 00:00:00 GMT syscfg bangladesh-bank swift lazarus north-korea federal-reserve money-laundering philippines casinos https://syscfg.sh/research/ashley-madison-breach https://syscfg.sh/research/ashley-madison-breach In 2015, the Impact Team stole and published the full user database of Ashley Madison - 37 million records including names, addresses, sexual preferences, and GPS coordinates. The breach triggered a mass extortion wave, documented suicides, and revealed that the majority of the platform's female accounts were company-operated bots. The human cost dwarfed any corporate financial penalty. Thu, 07 May 2026 00:00:00 GMT syscfg ashley-madison avid-life-media impact-team extortion fake-profiles fembots data-breach privacy https://syscfg.sh/research/conficker-worm-botnet https://syscfg.sh/research/conficker-worm-botnet In 2008, Conficker assembled the largest botnet in history - 9 to 15 million machines - using a zero-day Windows exploit and a domain generation algorithm that made C2 takedown nearly impossible. It triggered the first coordinated public-private industry response, a $250,000 Microsoft bounty, and global media panic about an April 1 activation date. Then it sent a little spam. The botnet's authors were never identified, and their true purpose was never established. Mon, 04 May 2026 00:00:00 GMT syscfg conficker botnet DGA MS08-067 windows p2p working-group ukraine https://syscfg.sh/research/morris-worm-1988 https://syscfg.sh/research/morris-worm-1988 On November 2, 1988, Robert Tappan Morris released a self-replicating worm onto the ARPANET that infected 6,000 machines - roughly 10% of the internet - in 24 hours. A design error intended to prevent detection caused runaway replication that crashed systems at MIT, Stanford, and Berkeley. Morris became the first person convicted under the Computer Fraud and Abuse Act. His worm created CERT, the institution of coordinated computer incident response, and demonstrated that networked systems could be weaponized at scale. Sun, 03 May 2026 00:00:00 GMT syscfg morris-worm 1988 arpanet buffer-overflow sendmail cfaa cert finger https://syscfg.sh/research/spectre-meltdown-cpu-vulnerabilities https://syscfg.sh/research/spectre-meltdown-cpu-vulnerabilities In January 2018, researchers disclosed two classes of CPU vulnerabilities that affected virtually every modern processor. Meltdown let any process read kernel memory. Spectre broke the isolation between programs by exploiting speculative execution. Neither had a complete fix - only mitigations that degraded performance by up to 30%. The story of an architectural flaw baked into two decades of chip design. Thu, 30 Apr 2026 00:00:00 GMT syscfg spectre meltdown cpu side-channel speculative-execution intel amd arm kernel kpti https://syscfg.sh/research/lapsus-group-extortion https://syscfg.sh/research/lapsus-group-extortion In three months, a group of teenagers compromised Microsoft, Nvidia, Samsung, Okta, T-Mobile, and Rockstar Games - leaking source code live on Telegram, holding Q&A sessions with followers, and recruiting insiders at $20,000 per week. Their primary tool was not malware but MFA fatigue, purchased credentials, and an almost theatrical disregard for getting caught. The primary suspect was 16 years old. Tue, 28 Apr 2026 00:00:00 GMT syscfg lapsus mfa-fatigue sim-swapping okta nvidia microsoft rockstar the-com social-engineering https://syscfg.sh/research/equifax-breach-apache-struts https://syscfg.sh/research/equifax-breach-apache-struts On the day CVE-2017-5638 was published, someone started exploiting it against Equifax. For 76 days, attackers moved through the network undetected while an expired SSL inspection certificate left monitoring tools blind to encrypted exfiltration. 147 million Social Security numbers, birth dates, and credit histories stolen. Attributed to PLA Unit 54. The story of how one credit bureau's security failures affected half of America. Wed, 22 Apr 2026 00:00:00 GMT syscfg equifax apache-struts cve-2017-5638 pla china credit-bureau ssl-inspection