Juniper ScreenOS (2015)
Unauthorized Code in the Firewall: When the Appliance Itself Was the Thing That Could Not Be Trusted
On December 17–18, 2015, Juniper disclosed that an internal source-code review had turned up unauthorized code in ScreenOS, the operating system behind its NetScreen firewalls. The advisory covered two separate backdoors: a hardcoded master password granting administrative access over SSH and Telnet (CVE-2015-7755), and an altered Q parameter in the Dual_EC_DRBG random number generator that let a passive eavesdropper decrypt VPN traffic (CVE-2015-7756). The earliest affected builds shipped in 2012, leaving the code in production for roughly three years, and Fox-IT recovered the backdoor password within six hours of disclosure. It is the clearest precedent for this week's NetScaler story — both turn on the uncomfortable fact that a security appliance's own firmware is evidence to be verified, not assumed.
The Uber Breach and Cover-Up (2016)
The Keys Were in the Repository: A Credential Leak That Became a Criminal Case About the Response
In October 2016, attackers reached a private GitHub repository used by Uber engineers, lifted AWS credentials committed into it, and used them to pull an S3 datastore holding records on roughly 57 million riders and drivers, including some 600,000 driver's licence numbers. Uber paid the attackers $100,000 routed through its bug-bounty programme and obtained non-disclosure agreements, and the breach stayed unreported until November 2017; the company's security chief was convicted of obstruction of justice and misprision of a felony in October 2022. It is the canonical version of the pattern in this week's credential research — a secret committed to a repository outlives the commit — and a reminder that incident-response records are themselves discoverable evidence.
Operation Cloud Hopper (2017)
One Door, Every Building: The Campaign That Made Managed Service Providers the Highest-Value Target in the Chain
Disclosed in April 2017 by PwC and BAE Systems, Operation Cloud Hopper documented how APT10 compromised managed service providers and then used the legitimate, trusted connections those providers held into client networks to reach an unprecedented breadth of victims across a dozen countries. Investigators faced a defining difficulty: from a client's perspective, the attacker's traffic arrived over exactly the channel their IT provider was supposed to use, at exactly the times support work normally happened. The case established that compromising the layer everyone trusts beats compromising anyone individually.
The Fake Researcher Campaign (2021)
Targeting the People Who Hunt: When Attackers Built a Research Community to Reach Its Members
In January 2021, Google's Threat Analysis Group exposed a North Korea-linked operation that spent months constructing a credible security-research presence — a research blog, guest posts, social media personas with genuine follower networks — for the sole purpose of approaching working vulnerability researchers and inviting them to collaborate on projects that carried a hidden payload. Several targets were compromised despite being precisely the audience most equipped to spot a malicious file, because the lure did not arrive as a file from a stranger; it arrived as a professional opportunity from a peer.