Real incidents, how they were found, and what closing them actually took.
Case study
A CERT advisory said the user data of India's largest regional OTT platform was for sale on the darknet. We were called in by referral, and had the sellers identified inside a week.
18 February 2024 · 6 min read
A zero-day against a smart-LED brand's IoT estate took every service down and wiped its cloud servers. Control was restored in three days — and the mobile apps turned out to be the way in.
22 January 2024 · 5 min read
Method
An IDOR in a hotel chain's payment flow was being used to book rooms and club events at prices nobody agreed to. Their own security team could not find it. Here is how the engagement actually ran.
30 November 2023 · 7 min read
