Long-form notes from the field. Malware I've reverse-engineered, pentest chains I've walked, history that still teaches me something. I write these mostly to remember — and because somebody out there is looking for the exact thing I couldn't find last year.
A top 10 tech company said 6.5 million passwords leaked in 2012. Four years later, 117 million surfaced for sale. How the attacker got in, how LinkedIn found out, and how they cleaned it up.
Two brothers from Lahore wrote the first IBM PC virus in 1986 — to fight piracy. Their names, address and phone number were inside the code. Four decades later, they run Pakistan's biggest ISP. A case study.
Sumit Gupta ran a small Delhi office that quietly phished 10,000+ inboxes belonging to politicians, journalists, NGOs and hedge funds for seven years. Citizen Lab finally pulled the curtain in 2020.
A criminal SaaS startup that franchised ransomware, took 20 percent off the top, and hit Travelex, JBS, Kaseya, Acer and Apple's supplier. Then the FBI, Cyber Command and the FSB caught up.
A Geelong bartender stumbled onto a 1am to 3am NAB ATM bug that paid out money he didn't have. He spent AU$1.6 million in 18 months and then walked into 60 Minutes Australia and confessed.
Founded by Sachin Dev Duggal, Builder.ai conned Microsoft, SoftBank and Qatar with an AI named Natasha. Behind the curtain: 700 engineers in India, a typing pool, and one of the cleanest tech cons of the AI boom.
A $100 login bought $10.7 million out of Citibank. The St. Petersburg group that found the door, the man who walked through it, and the X.25 network nobody was watching. A case study.