Analysis · Retrospective 2024
Old credentials opened Snowflake customer accounts
The 2024 Snowflake customer-account campaign followed stolen identities into database access and data export.
Topic
Cybercrime
The infrastructure and economics of online crime: botnets, ransomware groups, criminal marketplaces and the services that keep them running.
Technical Advisory · Retrospective 2024
ScreenConnect’s server was the high-value target
The February 2024 ScreenConnect flaws put server ownership, administrative reach and tenant boundaries in the response scope.
Technical Advisory · Retrospective 2023
CitrixBleed required a session response
CVE-2023-4966 linked a memory-disclosure flaw to reusable sessions that needed a separate recovery decision.
Analysis · Retrospective 2023
MOVEit: patching the transfer server did not settle the data exposure question
The 2023 campaign separated two jobs that incident tickets often collapse: closing the vulnerability and investigating earlier access.
Technical Advisory · Retrospective 2022
AiTM phishing: why a completed MFA prompt can still end in session theft
The recovery task follows the stolen session into the mailbox, its persistence settings and the business conversations it exposed.
Analysis · Retrospective 2020
SolarWinds put management-plane trust under scrutiny
SUNBURST made software provenance, management identities and independent recovery part of the same investigation.