Skip to main content
BhishmaSec
Security Intelligence Feed

Cybersecurity
Intelligence Blog

Principal architects reverse-engineer high-profile ransomware incidents, supply chain failures, nation-state APTs, and API breaches — surfacing structural weaknesses defenders can actually fix.

9+

Analyses

$4.6B+

Damages Covered

6

Threat Categories

Coverage Areas

Cloud Security
API Security
Nation-State APTs
Supply Chain
Ransomware
Identity & Access
Featured AnalysisJuly 2023·11 min read

In May 2023, Chinese espionage group Storm-0558 forged authentication tokens using a compromised Microsoft consumer signing key — silently reading the email of senior US officials including the Secretary of Commerce for over a month. No zero-day. No phishing. Just a signing key that should never have been reachable, combined with a validation boundary that should never have existed. This is the most significant cloud identity incident in enterprise security history.

Cloud SecurityIdentityMicrosoft AzureToken Forgery
Read Full Analysis →
Intelligence Archive
API Security10 min read

The Optus Breach: 10 Million Australians Exposed Because an API Endpoint Required No Authentication

In September 2022, Australia's second-largest telco lost the personal records of nearly 10 million customers — almost 40% of the Australian…

API SecurityBOLAUnauthenticated Endpoint
Ransomware Intelligence14 min read

Change Healthcare Ransomware: The $6 Billion Attack That Broke American Healthcare

On February 21, 2024, ALPHV/BlackCat ransomware operators took down the largest healthcare clearinghouse in the United States. No MFA on a l…

RansomwareHealthcareSupply Chain
Ransomware Intelligence13 min read

Marks & Spencer Ransomware: How a Single Help-Desk Call Brought Down Britain's Most Trusted Retailer

Over Easter weekend 2025, DragonForce ransomware operators — working through a Scattered Spider affiliate — took Marks & Spencer offline by…

RansomwareSocial EngineeringDragonForce
Ransomware Intelligence12 min read

CDK Global Ransomware: How One Software Vendor Paralyzed 15,000 Car Dealerships Overnight

In June 2024, BlackSuit ransomware operators hit CDK Global — the Dealer Management System powering half of North America's franchised car d…

RansomwareSupply ChainBlackSuit
Ransomware Intelligence11 min read

Co-op Group Ransomware: 20 Million Customer Records, a Proactive Shutdown, and What Proactive Containment Actually Costs

May 2025. Three weeks after Marks & Spencer was brought down by the same threat actor cluster, the Co-op Group detected an intrusion in prog…

RansomwareDragonForceScattered Spider