The one where a 404 page had 20 doors behind it
Two load balancers returned a blank “page not found.” We changed the name in the request, and 20+ restricted employee domains opened up.
Case Studies
These stories are real, but the details are redacted. The names? You’ll never know them. What we can share is how we uncovered the threats no one else could see, and why a constant, relentless attack is the best defense against today’s cyber threats.
Read MoreThe one where a 404 page had 20 doors behind it
The one where we counted sockets and took control.
Hi-vis jackets, a clipboard, and a story about counting sockets. That's all it took for a tailgating attack to bypass reception, reach the C-suite, and walk out with a corporate laptop, completely unchallenged.
The one where a Slack message became a supply chain backdoor.
A GitHub token, posted in Slack and left unrotated for over a year, gave us complete control over the organization's software supply chain, from proprietary code to every downstream build.
The one where we got their client’s data by simply asking nicely.
A year-long business email compromise campaign built entirely on AI social engineering: lookalike domains, a fabricated authority figure, and patient trust-building. No malware, no exploits, just an inbox and the words "this is approved."
The one where we used their own front door to knock.
No spoofed domain, no fake IT support call, just a contact form and a Business Development Director doing his job. A spear phishing attack that used the target's own sales process as the entry point, and a session hijacking payload most phishing write-ups never cover.
The one where “don’t get caught” was the only rule.
Two VMs, one rule: don't get caught. We tunneled in through an overlooked port, found cleartext credentials, and used pass-the-hash to compromise nearly every device in the subnet, undetected.
The one where our target wrote our phishing email for us.
A LinkedIn post celebrating a charity partnership gave an attacker everything needed for a convincing spear phishing example, a name, a role, a cause worth trusting. No tools, no infrastructure, just public information the target shared proudly.
The one where we stayed overnight and nobody noticed.
A single vishing call was enough. We talked our way past an MSP's help desk identity checks and added our own MFA device with a fabricated pretext. The compromise ran undetected for a full 15-hour shift.