Dark Perimeter: True Cybersecurity Stories

They built it to win at Minecraft. In 2016, three college students — Paras Jha, Josiah White, and Dalton Norman — created Mirai: a botnet that scanned the internet for cameras, DVRs, and home routers running factory-default passwords, and quietly recruited them into an army. At its peak: 600,000 devices. The largest DDoS weapon ever assembled. They used it against Minecraft rivals. Then against a...

March 2020. The Russian intelligence service SVR quietly inserted a backdoor into a software update for SolarWinds Orion — used by eighteen thousand organizations worldwide, including the Pentagon, Treasury, State Department, and the Department of Homeland Security. They were inside for eight months before a cybersecurity company named FireEye noticed something wrong with its own network — and dis...

Four things carried a critical severity rating this week, and they were not the same problem. Cole, Dr. Vance and Marcus Hale rank the week out loud, with reasons, because the ranking is the actual work. Cisco Catalyst SD-WAN Manager (CVE-2026-76504) , CVSS 9.8. A URL-encoding authentication bypass yielding admin API access. Cisco confirmed exploitation in the wild, learned of it through a TAC sup...

Three things happened in the last week that look like three different stories. Citrix shipped an emergency bulletin for NetScaler bugs that were already being exploited. GitLab patched a 9.9 in the gateway that runs its AI agents. Dell pushed six critical fixes for the component connecting enterprise storage arrays to Kubernetes. Cole Drayden, Dr. Elliott Vance and Marcus Hale argue they are one s...

August 2022. A developer's workstation at LastPass was compromised. The company disclosed it, said no customer data was affected, and moved on. They were wrong. Four months later, the attacker came back — this time for the vaults. Three hundred and fifty million encrypted password vaults. In the hands of an unknown adversary. Being cracked, one by one, to this day. The Breach Files: True cybe...

March 2022. A developer at Sky Mavis opened a PDF. Six hundred and twenty-five million dollars disappeared. The Ronin Network breach is the largest cryptocurrency theft in history. The attackers — North Korea's Lazarus Group — spent months positioning themselves before they moved. By the time anyone noticed, they were already gone. The Breach Files: True cybercrime. Dramatized. Support the sh...

They called themselves Scattered Spider. They were teenagers — mostly American, some British — operating from bedrooms, dorm rooms, and their parents' houses. Between 2022 and 2024, they breached over a hundred major corporations. MGM. Caesars. Dozens of telecoms. Companies worth hundreds of billions of dollars. The arrests came one at a time. The youngest was sixteen. The Breach Files: True...

May 7th, 2021. Colonial Pipeline shut down 5,500 miles of fuel infrastructure supplying 45 percent of the East Coast's gasoline. The key to America's fuel supply was a single recycled password with no second factor of authentication. DarkSide got four point four million dollars. The FBI got most of it back. DarkSide disappeared — only to resurface under a new name. The Breach Files: True...

September 2023. Las Vegas. The slot machines stopped. The hotel room key cards died. The reservations system went dark. Scattered Spider had been inside MGM Resorts for ten minutes of conversation before a help desk operator handed them the keys to one of the largest casino empires on earth. MGM refused to pay. It cost them a hundred million dollars. The Breach Files: True cybercrime. Dramatized....

September 2023. Las Vegas. The slot machines stopped. The hotel room key cards died. The reservations system went dark. Scattered Spider had been inside MGM Resorts for ten minutes of conversation before a help desk operator handed them the keys to one of the largest casino empires on earth. MGM refused to pay. It cost them a hundred million dollars. The Breach Files: True cybercrime. Dramatized....

July 15th, 2020. Barack Obama, Joe Biden, Elon Musk, Apple, and Uber all tweeted the same thing: send Bitcoin, get double back. It wasn't them. A seventeen-year-old in Florida had found a way inside Twitter's most protected systems — not by hacking the platform, but by paying someone already inside it. For four hours, the most powerful accounts on earth belonged to a teenager on Discord....

July 15th, 2020. Barack Obama, Joe Biden, Elon Musk, Apple, and Uber all tweeted the same thing: send Bitcoin, get double back. It wasn't them. A seventeen-year-old in Florida had found a way inside Twitter's most protected systems — not by hacking the platform, but by paying someone already inside it. For four hours, the most powerful accounts on earth belonged to a teenager on Discord....

A new strand on Dark Perimeter, pointed inward at the one perimeter nobody documents: your own. Cole Drayden breaks down what is actually happening when a manager reaches for a culprit instead of a cause, why blame lands hardest on the people who already hold themselves to a stricter standard, and why he forgets it in a week while you carry it far longer. Covered: blame as a coping mechanism for u...

May 12th, 2017. Across the United Kingdom, hospital screens turned blue. Operations cancelled. Patients turned away. Ambulances diverted. The NHS was under attack — not by a foreign army, but by ransomware built from a stolen American weapon. WannaCry was the most destructive cyberattack in history at the time of its release. The exploit behind it had been developed by the NSA, stolen by a group c...

May 12th, 2017. Across the United Kingdom, hospital screens turned blue. Operations cancelled. Patients turned away. Ambulances diverted. The NHS was under attack — not by a foreign army, but by ransomware built from a stolen American weapon. WannaCry was the most destructive cyberattack in history at the time of its release. The exploit behind it had been developed by the NSA, stolen by a group c...

On July 19, 2024, about 8.5 million Windows machines stopped working at once. Within hours CrowdStrike's CEO said publicly it was not a cyberattack. Two weeks later the company published a root cause analysis. Two months after that, an executive said it again under oath. Ask people today what happened, and many will tell you CrowdStrike got hacked. This episode is about the gap between what t...

He was eighteen years old. He had a laptop, a phone, and one phone call to make. In September 2022, a teenager known online as Teapot walked through the front door of Uber — not by breaking any encryption, not by exploiting a zero-day, but by calling a contractor at two in the morning and asking politely. What he found inside was worse than the entry. A PowerShell script on a network share. Hardco...

They were inside for seven days before anyone noticed. On April 30th, 2026, a hacker known as Phantom logged into a Canvas Free-For-Teacher account and pulled an API response he wasn't supposed to get. What he found: 275 million users across 8,800 institutions. Three point six five terabytes of data — names, student IDs, emails, and billions of private messages. Instructure thought they'...

Six hundred and forty seven thousand internet-exposed n8n instances, counted by software that then decided, on its own, which ones were worth attacking. We know that because the attacker's agent started a file server in its home directory and served its operator's entire environment to the internet, where Palo Alto's Unit 42 found it. Cole Drayden, Dr. Elliott Vance and Marcus Hale...

Eighty-eight percent. In the first half of 2026, according to CrowdStrike's 2026 Threat Hunting Report published August 3, that is the share of intrusions following a public vulnerability disclosure that occurred within forty-eight hours of that disclosure. Cole Drayden, Dr. Elliott Vance and Marcus Hale work through three stories from a single week and argue they are one story: The collapsed...

The practical episode. You run a security program, you have a finite budget, and leadership read a headline about a rogue AI. What actually changes on Monday. Part four of four. An honest accounting of what was genuinely new in this incident (tempo, endurance applied to breadth, and unprompted target selection) versus what was already sitting in your backlog (all of the techniques, without excepti...

On February 12, 2024, someone signed into a Citrix remote-access portal at Change Healthcare with a valid username and a valid password. Nine days later, the largest medical claims clearinghouse in the United States stopped, and with it the revenue cycle of hospitals, pharmacies, and physician practices across the country. Cole Drayden, Dr. Elliott Vance, and Marcus Hale open the Change Healthcare...

When Hugging Face went to reconstruct the intrusion, the frontier models they reached for refused. In their own words, the guardrails treated reverse engineering an exploit the same as launching one. So the defenders downloaded an open weight model, ran it locally, broke the attacker's chunk plus XOR plus gzip encoding, and recovered roughly four times more secrets than a plaintext scan of da...

In late July 2026, more than 30 community water systems in Minnesota were hit in a coordinated cyberattack that spread within a week to at least seven states. Operators were locked out of their own plants, utilities dropped to manual operation, and boil-water notices went out across the Midwest. In this Breach Files episode, Cole Drayden walks through what actually happened while it is still unfol...

Day three. Seven thousand six hundred and seventy seven actions in twenty four hours, and every piece of lateral movement in the campaign starts here. Part two of four. The Kubernetes phase: projected service account tokens, a CSI driver ClusterRole that granted pod creation cluster wide, no admission policy rejecting privileged or hostPath pods, and a self respawning fleet of privileged pods acro...