Learn about the individuals and groups behind cyberattacks, including nation-state hackers, cybercriminal organizations, hacktivists, and insider threats. These articles analyze motivations, tactics, and real-world examples to help you understand who poses risks to your digital assets.
posts
In March 2022, the Lapsus$ group didn't crack some zero-day vulnerability to breach Okta. They bribed an employee. They socially engineered their way into a third-party support provider and pivoted from there. No malware. No exploit kit. Just a human being making a decision. That single incident put
In February 2022, Nvidia — one of the largest chip manufacturers on the planet — confirmed it was hit by a ransomware attack. The threat actor group Lapsus$ claimed they stole over a terabyte of proprietary data and began leaking employee credentials and source code. If a company with Nvidia's
In May 2021, Colonial Pipeline paid $4.4 million in ransom after a single compromised password shut down fuel delivery across the Eastern United States. Months later, meat processor JBS paid $11 million to resume operations. If you searched for ransomware examples hoping to understand what these attacks actually look
A USB Drive in a Parking Lot Changed Everything In 2020, a Tesla employee was approached by a Russian national who offered him $1 million to plant malware inside the company's Nevada Gigafactory. The FBI arrested the threat actor before the attack succeeded, but the plan hinged on
Your Credentials Are Probably Already There In April 2021, a threat actor posted a database of 533 million Facebook user records — phone numbers, full names, locations, email addresses — on a popular dark web forum. For the price of nothing. Just sitting there, searchable. So what is the dark web, exactly,
During the 2020 SolarWinds breach investigation, I watched a boardroom full of executives stare blankly when an incident responder mentioned "lateral movement" and "supply chain compromise." They had no idea what was happening to their own network — not because they were negligent, but because nobody had
The Colonial Pipeline Attack Changed Everything In May 2021, a single compromised password led to the most disruptive cyberattack on U.S. critical infrastructure in history. DarkSide ransomware shut down Colonial Pipeline's 5,500-mile fuel system, triggering gas shortages across the eastern seaboard. The company paid a $4.
In March 2021, security researchers discovered that Accellion's file transfer appliance had been exploited through — you guessed it — an SQL injection vulnerability. The Clop ransomware gang leveraged the flaw to steal data from dozens of organizations, including Shell, Bombardier, and multiple U.S. universities. This wasn't
A Ransomware Group That Starts With Your Inbox In June 2021, a mid-sized manufacturer discovered every file server in their environment encrypted. The ransom note was signed "Medusa." The entry point? A single phishing email that harvested an employee's VPN credentials. The Medusa ransomware gang phishing
The Ransomware Epidemic Is Already Here When someone searches for ransomware examples — whether they're typing "2026" or any other year — they're really asking one question: what does a real ransomware attack look like, and how do I stop it from happening to me? I&
