Case Studies: Historical Grid
The Morris Worm (1988)
The First Autonomous Intruder: A Graduate Student's Experiment That Breached 6,000 Machines With No One at the Keyboard
In November 1988, a self-replicating program written by Cornell student Robert Tappan Morris escaped its author's control and infected an estimated 6,000 machines — roughly a tenth of the young internet — by autonomously exploiting sendmail, fingerd, and weak passwords. With no packet captures and no EDR, investigators at Berkeley, MIT, and Purdue decompiled the worm's code itself, making Gene Spafford's analysis one of the founding documents of malware forensics, and the case produced the first conviction under the Computer Fraud and Abuse Act. Thirty-eight years before an OpenAI agent walked through Hugging Face on its own, Morris proved the defining problem: when the intruder is a program, the investigation starts with reverse-engineering its intent.
Zeus (2007)
Stealing the Session, Not the Password: The Banking Trojan That Invented the Hidden Browser and Built a Criminal Industry
Surfacing in 2007, the Zeus trojan redefined financial malware by hijacking what victims already had: authenticated online-banking sessions, manipulated in real time through web injects and hidden-VNC modules that let operators drive the victim's browser invisibly, from the victim's own IP. The FBI's 2010 Operation Trident Breach charged over 100 money mules moving roughly $70 million, and after the source code leaked in 2011, Zeus's architecture spawned Gameover Zeus and a decade of descendants — down to this week's MedusaHVNC. Forensically, Zeus forced investigators to stop treating a "clean" login as innocent and start reconstructing session behavior — the very discipline that session-riding attacks still demand today.
WannaCry (2017)
The Ransomware That Needed No Hacker: How a Self-Spreading Worm Locked 200,000 Machines in a Single Weekend
In May 2017, WannaCry tore across 150 countries in hours, encrypting an estimated 200,000-plus computers — from the UK's National Health Service to Spanish telecoms — by welding ransomware to the leaked EternalBlue SMB exploit so it propagated on its own, with no phishing click and no operator at the keyboard. Investigators reconstructed its spread from network captures and the now-famous kill-switch domain, and Britain's NCSC later attributed it to North Korea's Lazarus Group. WannaCry proved that an automated, self-executing attack could outrun every human responder — the modern echo of the Morris Worm's lesson, and the ancestor of today's machine-speed, AI-driven intrusions.
The Mirai Botnet (2016)
An Army of Cameras That Recruited Itself: The IoT Worm That Broke the Internet, Then Open-Sourced Its Own Blueprint
In late 2016, the Mirai botnet marshaled hundreds of thousands of hijacked cameras and routers by automatically scanning the internet for devices still using factory-default passwords, then hurled record-breaking DDoS floods that knocked out Dyn's DNS and much of the U.S. East Coast's web access. Forensic teams traced the takedowns to the self-propagating worm, and when its author dumped the source code publicly, the automation replicated into countless variants overnight. Mirai showed how attack logic, once automated and released, perpetuates without its creator — the same runaway-automation problem investigators now face as AI models generate and drive attacks on their own.
— Page 2 —