Huntress Looks Back at 10 Cybersecurity Events That Shaped the Past Decade
Summary
Huntress reviews 10 major cyber incidents and enforcement actions from 2017 to 2025, highlighting lessons about software supply chains, patching, credential security, ransomware, and coordinated defense.
Key points
- The article describes NotPetya’s spread through a compromised M.E.Doc software update and its destructive impact on organizations worldwide.
- It recounts how attackers exploited an unpatched Apache Struts flaw in the Equifax breach, which exposed personal information belonging to 147 million Americans.
- The SolarWinds compromise and MOVEit exploitation illustrate how attacks on widely used software can affect many downstream organizations.
- The Hafnium attacks and Log4Shell response are presented as examples of the challenges of patching exposed systems and tracking software components.
- The article says Colonial Pipeline was attacked after a VPN account password was compromised; the account lacked MFA.
- It highlights the Qakbot takedown and Operation Endgame, which disrupted malware infrastructure through international law-enforcement action.
Article Details
- Topic
- Retrospective of influential cyber incidents, vulnerabilities, ransomware attacks, and law-enforcement takedowns from 2017 to 2025.
MITRE ATT&CK
T1056.001 · KeyloggingQakbot was described as collecting keystrokes from infected computers.T1190 · Exploit Public-Facing ApplicationAttackers exploited internet-exposed vulnerabilities in Equifax's web application, Microsoft Exchange servers, MOVEit Transfer, and ScreenConnect.T1195.002 · Compromise Software Supply ChainNotPetya spread through a compromised M.E.Doc software update, and the SolarWinds attack injected malicious code into an Orion software update.T1485 · Data DestructionNotPetya was a destructive wiper designed to destroy data and permanently damage systems.T1486 · Data Encrypted for ImpactRansomware attacks described in the article encrypted victims' systems or business data, including the Colonial Pipeline and ScreenConnect incidents.T1566.001 · Spearphishing AttachmentQakbot typically spread through email attachments disguised as business documents.
CVE
CVE-2017-0144This exploit was based on a Microsoft zero-day flaw (CVE-2017-0144) and was also used in the WannaCry attack the month prior.CVE-2017-5638It all began with CVE-2017-5638, a critical vulnerability in Apache Struts 2, a popular web application framework.CVE-2021-26855These vulnerabilities, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065, affected Exchange Server 2013, 2016, and 2019 and created a perfect storm of security weaknesses that attackers chained togetherCVE-2021-26857These vulnerabilities, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065, affected Exchange Server 2013, 2016, and 2019 and created a perfect storm of security weaknesses that attackers chained togetherCVE-2021-26858These vulnerabilities, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065, affected Exchange Server 2013, 2016, and 2019 and created a perfect storm of security weaknesses that attackers chained togetherCVE-2021-27065These vulnerabilities, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065, affected Exchange Server 2013, 2016, and 2019 and created a perfect storm of security weaknesses that attackers chained togetherCVE-2021-44228When security researchers discovered CVE-2021-44228, better known as Log4Shell, they uncovered a zero-day vulnerability so severe that it earned a perfect 10.0 CVSS score.CVE-2023-34362The cl0p ransomware gang exploited a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software’s MOVEit managed file transfer (MFT) software, a tool for exchanging sensitive data.CVE-2024-1708CVE-2024-1709 and CVE-2024-1708 were a breeze for attackers to exploit:CVE-2024-1709CVE-2024-1709 and CVE-2024-1708 were a breeze for attackers to exploit:
Threat Actors
Malware
BumbleBeeMalware families that have infected millions of computers and have been tracked in the wild by our security researchers at Huntress were disrupted, including Qakbot, DanaBot, Lactrodectus, and Bumblebee.DanabotMalware families that have infected millions of computers and have been tracked in the wild by our security researchers at Huntress were disrupted, including Qakbot, DanaBot, Lactrodectus, and Bumblebee.LactrodectusMalware families that have infected millions of computers and have been tracked in the wild by our security researchers at Huntress were disrupted, including Qakbot, DanaBot, Lactrodectus, and Bumblebee.NotPetya1. NotPetya attack (June 2017)Qakbot8. Qakbot malware takedown (August 2023)
Vendors
Apache Software FoundationWhen the Apache Software Foundation announced this security flaw in March 2017, they immediately provided a patch, but, unfortunately, Equifax took a slower (and riskier) approach.ConnectWiseConnectWise ScreenConnect, a widely used remote monitoring and management (RMM) tool, was the latest company to warn of two critical vulnerabilities.M.E.DocNotPetya initially targeted Ukrainian businesses, spreading through a compromised software update from M.E.Doc, a popular Ukrainian accounting program.MicrosoftThis exploit was based on a Microsoft zero-day flaw (CVE-2017-0144) and was also used in the WannaCry attack the month prior.Progress SoftwareThe cl0p ransomware gang exploited a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software’s MOVEit managed file transfer (MFT) software, a tool for exchanging sensitive data.SolarWinds3. SolarWinds supply chain attack (December 2020)
Products
M.E.DocNotPetya initially targeted Ukrainian businesses, spreading through a compromised software update from M.E.Doc, a popular Ukrainian accounting program.Microsoft Exchange Server4. Hafnium attack: Microsoft Exchange Server vulnerabilities (March 2021)Progress MOVEit Transfer7. MOVEit Transfer vulnerability exploitation (May-June 2023)ScreenConnect9. ScreenConnect authentication bypass (February 2024)SolarWinds OrionThis monumental attack took advantage of a software update in the SolarWinds Orion platform.
Tools
Countries
Industries
GovernmentAlmost 18,000 organizations worldwide received the compromised SolarWinds software update, including Fortune 500 companies and influential government agencies.HealthcareHealthcare systems, financial institutions, government agencies, and private companies fell victim to this single point of failure in MOVEit, which billed itself as a trusted third-party software solution.ShippingBut by the end of the day, global supply chains were paralyzed, hospitals were forced offline, and shipping giant Maersk was operating with pen and paper across 76 ports worldwide.