Target Sector: Information Technology & Cloud
Court filings, technical advisories, and SEC Form 8-K enforcement disclosures documenting cyber intrusions against organizations in Information Technology & Cloud.
Key Facts
- 20 documented prosecution and advisory matters targeting Information Technology & Cloud.
- Cumulative reported financial losses exceed $12.6 billion.
- 9 of 20 cases reached conviction, guilty plea, or final sentencing.
- Tracked actors include APT29, REvil / Sodinokibi, Scattered Spider / UNC5537, BlackSuit Ransomware Group.
Documented Incidents (20)
SolarWinds Orion Supply Chain Intrusion (APT29 / SVR)
Sophisticated software supply chain compromise by the Russian Foreign Intelligence Service (SVR), inserting the SUNBURST backdoor into updates of SolarWinds Orion software and compromising multiple federal agencies.
U.S. v. Yaroslav Vasinskyi (Kaseya VSA / REvil Ransomware)
Ukrainian national and REvil ransomware affiliate responsible for deploying the ransomware attack that hijacked Kaseya VSA management software, instantly encrypting up to 1,500 downstream businesses on July 4th weekend.
U.S. v. Baratov et al. (Yahoo 2014 Breach / FSB Officers)
Conspiracy between Russian Federal Security Service (FSB) officers and criminal hackers to breach Yahoo's network, compromising 500 million user accounts to conduct espionage against journalists, government officials, and commercial executives.
U.S. v. Paige Thompson (Capital One Cloud Breach)
Former Seattle cloud engineer who identified misconfigured web application firewalls to gain unauthorized access to Capital One's Amazon Web Services storage buckets, exfiltrating 106 million customer credit card applications.
U.S. v. Yevgeniy Nikulin (LinkedIn & Dropbox Breaches)
Russian national who hacked into the corporate networks of LinkedIn, Dropbox, and Formspring, stealing login credentials of over 100 million users and selling the stolen database dumps on darknet forums.
U.S. v. Kirill Victorovich Firsov (Deer.io Dark Web Shop)
Russian administrator of Deer.io, a decentralized cyber storefront platform hosting over 24,000 active automated shops selling hacked accounts, corporate credentials, and identity documents.
U.S. v. Brett Johnson (ShadowCrew Cybercrime Syndicate)
Pioneering cybercriminal known as 'The Original Internet Godfather' who built and operated ShadowCrew, the prototypical dark web marketplace for trafficking in stolen identities and credit card data.
Snowflake Enterprise Credential Stuffing & Customer Cloud Thefts
Financially motivated threat actor collective UNC5537 systematically infiltrated over 165 corporate customer tenants hosted on Snowflake (including Ticketmaster, Santander Bank, Advance Auto Parts, and LendingTree). Attackers leveraged infostealer malware logs dating back years against enterprise user accounts that lacked multi-factor authentication and IP network allowlists, exfiltrating billions of consumer records.
CDK Global BlackSuit Ransomware Incident
Destructive ransomware incident that incapacitated CDK Global, the premier SaaS dealer management platform for approximately 15,000 car dealerships across North America. Attackers deployed BlackSuit ransomware throughout CDK cloud and on-premises data centers, forcing dealership employees into pen-and-paper workarounds for weeks until an estimated $25 million ransom was transferred.
Microsoft Corporate Executive Email Intrusion (Midnight Blizzard / SVR)
Russian Foreign Intelligence Service (SVR / Midnight Blizzard / APT29) compromised Microsoft corporate email systems via a password spray campaign against a legacy non-production test tenant lacking multi-factor authentication. Attackers leveraged the test account's permissions to grant full OAuth app-level access, reading executive emails and exfiltrating source code and customer cryptographic secrets.
MOVEit Transfer Mass Zero-Day Extortion Campaign
Mass cyber extortion campaign exploiting a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software MOVEit Transfer appliances, exfiltrating personal records of over 90 million individuals across 2,700 organizations without encrypting files.
Okta Customer Support Console Intrusion (LAPSUS$)
Teenage cyber extortion collective LAPSUS$ compromised a third-party customer support contractor (Sitel) workstation via an active RDP session, gaining access to Okta SuperUser administrative diagnostic tools affecting 366 enterprise tenants.
LastPass DevOps Engineer Home Breach & Vault Exfiltration
Adversaries compromised a senior DevOps engineer home computer by exploiting a remote code execution vulnerability in Plex Media Server, implanted keyloggers to capture master vault credentials, and exfiltrated encrypted customer password vaults from AWS S3 storage.
U.S. v. Joseph Sullivan (Uber Breach Extortion Cover-up)
Historic federal criminal prosecution of former Uber Chief Security Officer Joseph Sullivan for obstruction of justice and misprision of a felony after concealing a massive breach of 57 million user and driver records by paying $100,000 in Bitcoin through a bug bounty program under non-disclosure agreements.
Hewlett Packard Enterprise M365 Email Breach (Midnight Blizzard)
State-sponsored cyber espionage campaign conducted by Russian Foreign Intelligence Service (SVR) unit Midnight Blizzard (APT29) infiltrating Hewlett Packard Enterprise cloud-hosted Microsoft Office 365 environment, accessing executive leadership and cybersecurity correspondence, disclosed under SEC Form 8-K filings.
CrowdStrike Falcon Sensor Channel File 291 Global Windows Outage
Unprecedented global IT blackout triggered by an invalid content configuration update (Channel File 291) deployed to CrowdStrike Falcon sensor software, crashing 8.5 million Microsoft Windows devices into unbootable Blue Screen of Death loops, paralyzing commercial aviation, healthcare systems, and retail banks worldwide.
XZ Utils liblzma Upstream Linux Supply Chain Backdoor (CVE-2024-3094)
Sophisticated multi-year social engineering and software supply chain operation where persona Jia Tan gained co-maintainer status on the foundational open-source xz compression project, embedding a multi-stage obfuscated backdoor into liblzma tarballs that hijacked OpenSSH sshd authentication to enable unauthorized pre-auth remote code execution.
Log4Shell Ubiquitous Remote Code Execution Crisis (CVE-2021-44228)
Universal zero-day vulnerability in Apache Log4j (Log4Shell) where arbitrary JNDI lookup strings (${jndi:ldap://...}) processed by logger components permitted unauthenticated remote code execution, triggering mass scanning and exploitation across billions of enterprise cloud servers by nation-state actors and ransomware syndicates worldwide.
U.S. v. Maxim Senakh (Ebury Linux SSH Rootkit & Botnet)
Russian national arrested in Finland, extradited to the United States, and sentenced to 46 months imprisonment in federal court for operating the Ebury botnet, which infected over 25,000 Linux enterprise web servers with a stealth OpenSSH backdoor to harvest system credentials and divert web traffic.
SEC v. Blackbaud, Inc. (Misleading Ransomware Disclosure)
Landmark Securities and Exchange Commission enforcement order against public cloud software provider Blackbaud for making materially misleading disclosures concerning a May 2020 ransomware incident, omitting that attacker had exfiltrated unencrypted donor bank account and social security information while asserting sensitive data was not compromised.