Iranian-affiliated actors spent eighteen months inside internet-exposed PLCs across US water, energy and government facilities, stealing plant project files and rewriting Add-On Instructions to disable shutdown and alarm logic — then triggered coordinated disruption at ~36 Minnesota water systems and utilities in twelve states on 26–27 July 2026, four days after CISA updated advisory AA26-097A. No zero-day was used: internet exposure, default credentials and an unpatchable Rockwell auth bypass were sufficient.

Sandworm's VPNFilter successor quietly turned thousands of WatchGuard firewalls and ASUS routers into durable botnet infrastructure for two and a half years, undetected until a joint CISA/NCSC advisory exposed it one day before Russia's invasion of Ukraine — a DOJ court-authorized operation remotely disabled the botnet the following month.

A single compromised, MFA-less legacy VPN password let a DarkSide affiliate sit inside Colonial Pipeline's IT network for eight days before encrypting its billing systems — the resulting precautionary shutdown of the largest U.S. fuel pipeline, without any OT/ICS compromise, triggered a six-day East Coast fuel crisis, a $4.4M ransom, and the first mandatory federal pipeline cybersecurity regulations.

A Russian military wiper disguised as ransomware, delivered through a hijacked Ukrainian tax-software update, spread worldwide and wiped Maersk's entire global IT estate in minutes — the company rebuilt 4,000 servers and 45,000 PCs in 10 days after a lone surviving domain controller in Ghana, saved by a power outage, became the only copy of its Active Directory left anywhere on Earth.

North Korean state hackers used stolen SWIFT credentials and custom anti-forensic malware to attempt a $951M theft from Bangladesh's central bank; a misspelled word blocked most of it, but $81M still reached Manila and vanished into the Philippine casino system.

One overlooked server in an otherwise complete two-factor authentication rollout let intruders roam 90 JPMorgan servers for two months, stealing contact data on 83 million accounts — a breach the FBI first suspected was Russian state retaliation, until a 2015 indictment unmasked it as a transnational pump-and-dump securities fraud ring instead.

A self-declared "hacktivist" collective knocked dozens of major U.S. banks offline with unprecedented DDoS volumes over three announced phases — a front that took the DOJ over three years to formally unmask as an IRGC-run operation, whose operators separately breached a small New York dam's control system along the way.

Sony BMG shipped kernel-level cloaking DRM (XCP, MediaMax) on tens of millions of audio CDs; independent researcher Mark Russinovich exposed it as rootkit-class software in Oct 2005, and criminal malware weaponized the cloak within ten days.

The first mass-mailing macro virus to hit internet scale, spreading through Word documents that auto-emailed themselves to a victim's first 50 Outlook contacts and forcing Microsoft, Intel, and Lockheed Martin to shut down email entirely within 72 hours.

First self-propagating worm to achieve mass spread across the early Internet, disabling ~6,000 of ~60,000 connected hosts via a miscalibrated reinfection check; led directly to the founding of CERT/CC and the first CFAA prosecution.

Subject of Kevin Poulsen's "Kingpin" — a former FBI informant turned hacker who hijacked four rival carding forums in a single night, trafficked ~2M stolen cards, and drew the longest US hacking sentence of its time.

Widely regarded as "Web War I" — a 22-day DDoS campaign that paralyzed Estonian banking, government, and media after the Bronze Soldier statue's relocation, directly leading to NATO's Tallinn cyber-defense centre and the Tallinn Manual.

Zero-day-enabled espionage campaign that breached Google and 30+ other companies to steal source code and target Gmail accounts of Chinese human-rights activists; prompted Google's exit from mainland Chinese search.