DragonForce ransomware: the cartel that took down M&S and Co-op
DragonForce took down Marks & Spencer with a phone call to the helpdesk: it stole NTDS.dit and locked ESXi. A cartel …
Incident Response 38 posts
Information security in plain English: scams, hardening and privacy — plus retrogaming, games and geek culture.
MOVEit: 3 years on from the zero-day that exposed 93 million records
On 31 May 2023, CVE-2023-34362 in MOVEit Transfer became the largest supply chain attack by SQL injection in history, …
CISA leaked AWS GovCloud credentials on GitHub for 6 months
A CISA contractor published AWS GovCloud account credentials, SSH keys and plain-text passwords in a public repo — and …
Carnival Corporation: 6m customers leaked by ShinyHunters
Carnival Corporation had 6 million customers exposed after ShinyHunters tricked an employee through social engineering …
CVE-2026-42897: Exchange OWA zero-day exploited with no patch
Opening an email in Exchange OWA can compromise your authenticated session. CVE-2026-42897 is active with no permanent …
GitHub hacked via a VS Code extension: the TeamPCP case
A corrupted VS Code extension was live for 18 minutes and cost GitHub 3,800 internal repositories. Here's how that …
PowerShell for auditing Windows security logs
Use Get-WinEvent in PowerShell to monitor critical Windows events: failed logins, new processes and brute force …
Trellix hacked: source code from McAfee+FireEye stolen
RansomHouse accessed Trellix's repository in April and stole source code from the company that protects 50,000 …