PLATE 001 / First-party company photograph
Norsk Hydro chose transparency and manual operations over ransom
Company photograph illustrating Hydro’s own cyberattack retrospective; not a documented photograph of the incident itself.
Norsk Hydro ↗Visual index / source-first research
The image.
And the context behind it.
Explore the complete image register: original research figures, company photography, source illustrations and technical screenshots. Credits and case-file links stay attached.
117 image records
Logos, illustrations, source figures and photographs retain their original context. Read the caption and follow the source to understand what each image shows.
PLATE 002 / Original research diagram
3CX demonstrated a supply-chain compromise that began with another supplier
Figure 1 from Mandiant’s April 2023 investigation. The diagram represents the investigators’ reconstruction.
Mandiant / Google Cloud ↗PLATE 003 / Original vulnerability mark
Heartbleed forced the web to assume its encryption keys were exposed
Original vulnerability identification mark, not an image of an attack. The source page states CC0 for this logo.
Codenomicon / Heartbleed.com ↗PLATE 004 / Original research figure
Old infostealer logins opened Snowflake accounts that lacked MFA
Original figure from Mandiant’s June 2024 investigation; it reflects the report’s investigative scope.
Mandiant / Google Cloud ↗PLATE 005 / Source-published screengrab
A patched SharePoint flaw was bypassed before every version got a fix
Source-published technical screenshot from Microsoft’s July 2025 investigation; shown as an evidence exhibit.
Microsoft Threat Intelligence ↗PLATE 006 / Archival visual
The 1988 internet worm exposed a missing security focal point
Archival photograph of the Morris worm source-code disk. It provides historical context.
Case context · Greenlight ↗PLATE 007 / Archival visual
Stuxnet altered industrial controllers while reporting normal operation
Contextual image accompanying the Stuxnet case file. It is not a direct record of malware activity.
Case context · Greenlight ↗PLATE 008 / Archival visual
Heartbleed forced the web to assume its encryption keys were exposed
The Heartbleed identification mark. It identifies the vulnerability; it does not depict an attack.
Case context · Greenlight ↗PLATE 009 / Archival visual
WannaCry spread through a patched flaw the NHS had not applied
WannaCry-era visual. It does not identify a particular victim or affected system.
Case context · Greenlight ↗PLATE 010 / Archival visual
NotPetya spread through a tax-software update and became a wiper
outbreak-era screen image; illustrative context only, not a technical indicator or proof of a specific intrusion.
Case context · Greenlight ↗PLATE 011 / Archival visual
Equifax left a known web-framework flaw unpatched for months
corporate-location photograph used as historical context, not as evidence of breach activity.
Case context · Greenlight ↗PLATE 012 / Archival visual
FORCEDENTRY · 2021
Conceptual smartphone illustration supplied with the original guide; not a device screenshot or forensic exhibit. No separate case article was added in this pass.
Case context · Greenlight ↗PLATE 013 / Archival visual
A ubiquitous logging library accepted attacker-controlled lookups
project-identification visual; it represents the affected software project, not a vulnerability exploit or victim system.
Case context · Greenlight ↗PLATE 014 / Archival visual
A backdoored SolarWinds update reached thousands of networks at once
company-location photograph accompanying the SolarWinds case file; not an image of the intrusion.
Case context · Greenlight ↗PLATE 015 / Archival visual
A slow SSH login exposed a years-long backdoor in xz Utils
Advisory illustration for the XZ Utils backdoor. Read the case file for the supporting evidence.
Case context · Greenlight ↗PLATE 016 / Source editorial illustration
F5's incident disclosure turned supplier trust into an inventory problem
Editorial artwork from F5’s account of its security incident. Illustration, not documentary evidence of the intrusion.
F5 ↗PLATE 017 / Source editorial illustration
Open-source repository compromises forced a broader supply-chain playbook
Editorial artwork accompanying supply-chain mitigation guidance; not a diagram of a specific compromise.
Mandiant / Google Cloud ↗PLATE 018 / Source editorial illustration
Passkey-themed social engineering targeted the enrollment path
Microsoft security editorial illustration retained from the original identity-analysis card. Not a screenshot of the reported campaign.
Microsoft Security Blog ↗PLATE 019 / sourced visual
The 1988 internet worm exposed a missing security focal point
Visual published by palentino.es, shown for identification of the record.
palentino.es ↗PLATE 020 / sourced visual
A 376-byte worm reached most vulnerable hosts within ten minutes
Visual published by photo-baomoi.bmcdn.me, shown for identification of the record.
photo-baomoi.bmcdn.me ↗PLATE 021 / source-published visual
Conficker outlived its patch and forced a coordinated industry defense
Visual published with the cited source, shown for identification of the record.
learn.microsoft.com ↗PLATE 022 / sourced visual
Stuxnet altered industrial controllers while reporting normal operation
Visual published by wonderfulengineering.com, shown for identification of the record.
wonderfulengineering.com ↗PLATE 023 / sourced visual
A vendor's stolen credentials opened Target's payment network
Visual published by blogger.googleusercontent.com, shown for identification of the record.
blogger.googleusercontent.com ↗PLATE 024 / sourced visual
Heartbleed forced the web to assume its encryption keys were exposed
Visual published by cdn.publish0x.com, shown for identification of the record.
cdn.publish0x.com ↗PLATE 025 / source-published visual
OPM's breach exposed background-investigation records for millions
Visual published with the cited source, shown for identification of the record.
oversight.house.gov ↗PLATE 026 / sourced visual
Ukraine's 2015 grid attack was stopped by switching to manual control
Visual published by m.antikor.ua, shown for identification of the record.
m.antikor.ua ↗PLATE 027 / sourced visual
Default passwords on IoT devices built a record-setting botnet
Visual published by api.moneyoval.com, shown for identification of the record.
api.moneyoval.com ↗PLATE 028 / sourced visual
WannaCry spread through a patched flaw the NHS had not applied
Visual published by learn.microsoft.com, shown for identification of the record.
learn.microsoft.com ↗PLATE 029 / sourced visual
NotPetya spread through a tax-software update and became a wiper
Visual published by gov.uk, shown for identification of the record.
gov.uk ↗PLATE 030 / sourced visual
Equifax left a known web-framework flaw unpatched for months
Visual published by ftc.gov, shown for identification of the record.
ftc.gov ↗PLATE 031 / sourced visual
The Sony Pictures attack paired data leaks with disk-wiping malware
Visual published by home.treasury.gov, shown for identification of the record.
home.treasury.gov ↗PLATE 032 / sourced visual
A decades-old Bash flaw called Shellshock reached the web via CGI
Visual published by securityaffairs.com, shown for identification of the record.
securityaffairs.com ↗PLATE 033 / sourced visual
Meltdown and Spectre showed processors leaking memory across bounds
Visual published by cdnglobal.secnews.gr, shown for identification of the record.
cdnglobal.secnews.gr ↗PLATE 034 / sourced visual
GDPR gave data breach notification a 72-hour clock in 2018
Visual published by oneplacesolutions.com, shown for identification of the record.
oneplacesolutions.com ↗PLATE 035 / sourced visual
MITRE ATT&CK turned observed adversary behavior into shared terms
Visual published by cdn.prod.website-files.com, shown for identification of the record.
cdn.prod.website-files.com ↗PLATE 036 / source-published visual
Microsoft patched the SMB flaw two months before WannaCry hit
Visual published with the cited source, shown for identification of the record.
learn.microsoft.com ↗PLATE 037 / sourced visual
Yahoo waited two years to tell investors about its 2014 breach
Visual published by myinformernews.com, shown for identification of the record.
myinformernews.com ↗PLATE 038 / sourced visual
Norsk Hydro chose transparency and manual operations over ransom
Visual published by blogapp.bitdefender.com, shown for identification of the record.
blogapp.bitdefender.com ↗PLATE 039 / sourced visual
A misconfigured firewall exposed 100 million Capital One records
Visual published by occ.gov, shown for identification of the record.
occ.gov ↗PLATE 040 / sourced visual
NIST defined zero trust in seven tenets, not a single product
Visual published by linux-abos.com, shown for identification of the record.
linux-abos.com ↗PLATE 041 / sourced visual
Phone calls to Twitter staff reached tools that could take over any account
Visual published by etimg.etb2bimg.com, shown for identification of the record.
etimg.etb2bimg.com ↗PLATE 042 / sourced visual
A backdoored SolarWinds update reached thousands of networks at once
Visual published by miro.medium.com, shown for identification of the record.
miro.medium.com ↗PLATE 043 / sourced visual
Treasury warned that paying some ransomware gangs could break sanctions law
Visual published by infocrypto.fr, shown for identification of the record.
infocrypto.fr ↗PLATE 044 / sourced visual
A Citrix gateway flaw sat unpatched for a month while attacks began
Visual published by myce.wiki, shown for identification of the record.
myce.wiki ↗PLATE 045 / sourced visual
Zerologon let an unauthenticated attacker on the network seize a domain
Visual published by img2022.cnblogs.com, shown for identification of the record.
img2022.cnblogs.com ↗PLATE 046 / sourced visual
A hospital chain's ransomware outage became a securities disclosure test
Visual published by substackcdn.com, shown for identification of the record.
substackcdn.com ↗PLATE 047 / sourced visual
Unpatched Exchange servers fell within days of a March 2021 fix
Visual published by microsoft.com, shown for identification of the record.
microsoft.com ↗PLATE 048 / sourced visual
Colonial Pipeline shut itself down before ransomware reached the pumps
Visual published by tsa.gov, shown for identification of the record.
tsa.gov ↗PLATE 049 / sourced visual
JBS paid its ransom after most plants were already running
Visual published by images.wsj.net, shown for identification of the record.
images.wsj.net ↗PLATE 050 / sourced visual
A holiday-weekend update pushed ransomware through Kaseya's customers
Visual published by australiancybersecuritymagazine.com.au, shown for identification of the record.
australiancybersecuritymagazine.com.au ↗PLATE 051 / sourced visual
A directive replaced severity scores with evidence of exploitation
Visual published by reg4tech.com, shown for identification of the record.
reg4tech.com ↗PLATE 052 / sourced visual
A ubiquitous logging library accepted attacker-controlled lookups
Visual published by kadvacorp.com, shown for identification of the record.
kadvacorp.com ↗PLATE 053 / sourced visual
The government defined what a software parts list must contain
Visual published by cisa.gov, shown for identification of the record.
cisa.gov ↗PLATE 054 / sourced visual
A ransomware attack cost Ireland's health service its whole network
Visual published by preprod.admin.dr-imago.eu, shown for identification of the record.
preprod.admin.dr-imago.eu ↗PLATE 055 / sourced visual
A modified upload script quietly copied secrets from CI pipelines
Visual published by canada1.discourse-cdn.com, shown for identification of the record.
canada1.discourse-cdn.com ↗PLATE 056 / sourced visual
A ransomware group's leaked chats followed its public stand on the war
Visual published by image.theregister.com, shown for identification of the record.
image.theregister.com ↗PLATE 057 / sourced visual
A federal review found SMS and voice MFA failed against Lapsus$
Visual published by microsoft.com, shown for identification of the record.
microsoft.com ↗PLATE 058 / sourced visual
Apple, Google and Microsoft committed to passkeys on the same day
Visual published by storage.googleapis.com, shown for identification of the record.
storage.googleapis.com ↗PLATE 059 / source-published visual
DOJ said good-faith security research should not be charged
Visual published with the cited source, shown for identification of the record.
justice.gov ↗PLATE 060 / sourced visual
A federal jury convicted Uber's ex-security chief over a hidden breach
Visual published by ftc.gov, shown for identification of the record.
ftc.gov ↗PLATE 061 / sourced visual
LastPass's encrypted vault backups were stolen for offline attack
Visual published by informationage-production.s3.amazonaws.com, shown for identification of the record.
informationage-production.s3.amazonaws.com ↗PLATE 062 / sourced visual
A contractor's fatigue let one attacker into Uber's internal tools
Visual published by blogger.googleusercontent.com, shown for identification of the record.
blogger.googleusercontent.com ↗PLATE 063 / source-published visual
A 2022 law created reporting duties still waiting on a final rule
Visual published with the cited source, shown for identification of the record.
cisa.gov ↗PLATE 064 / sourced visual
Viasat's satellite modems were disabled an hour before an invasion
Visual published by viasat.com, shown for identification of the record.
viasat.com ↗PLATE 065 / sourced visual
OpenSSL downgraded a pre-announced critical flaw on release day
Visual published by img.helpnetsecurity.com, shown for identification of the record.
img.helpnetsecurity.com ↗PLATE 066 / source-published visual
One file-transfer flaw let attackers steal data at thousands of firms
Visual published with the cited source, shown for identification of the record.
cisa.gov ↗PLATE 067 / sourced visual
Forged Microsoft tokens gave a hacking group access to government email
Visual published by dhs.gov, shown for identification of the record.
dhs.gov ↗PLATE 068 / sourced visual
Two casinos took different paths after help-desk social engineering
Visual published by casino.org, shown for identification of the record.
casino.org ↗PLATE 069 / sourced visual
A 2023 strategy proposed shifting cyber liability onto software makers
Visual published by mayerbrown.com, shown for identification of the record.
mayerbrown.com ↗PLATE 070 / sourced visual
Public companies must now disclose material breaches within days
Visual published by img.decrypt.co, shown for identification of the record.
img.decrypt.co ↗PLATE 071 / sourced visual
A stolen Okta support credential exposed customers' session files
Visual published by nhub.news, shown for identification of the record.
nhub.news ↗PLATE 072 / sourced visual
A NetScaler flaw let stolen sessions outlive a security patch
Visual published by cdnglobal.secnews.gr, shown for identification of the record.
cdnglobal.secnews.gr ↗PLATE 073 / source-published visual
Secure by Design shifted attention from users to product makers
Visual published with the cited source, shown for identification of the record.
cisa.gov ↗PLATE 074 / sourced visual
A Citrix portal without MFA halted claims across US health care
Visual published by dehayf5mhw1h7.cloudfront.net, shown for identification of the record.
dehayf5mhw1h7.cloudfront.net ↗PLATE 075 / source-published visual
Operation Cronos seized LockBit's infrastructure and named a leader
Visual published with the cited source, shown for identification of the record.
nationalcrimeagency.gov.uk ↗PLATE 076 / source-published visual
An FBI takedown slowed ALPHV but did not end its affiliate model
Visual published with the cited source, shown for identification of the record.
cisa.gov ↗PLATE 077 / source-published visual
CSF 2.0 added a Govern function and widened who it is for
Visual published with the cited source, shown for identification of the record.
nist.gov ↗PLATE 078 / sourced visual
A slow SSH login exposed a years-long backdoor in xz Utils
Visual published by miro.medium.com, shown for identification of the record.
miro.medium.com ↗PLATE 079 / sourced visual
Old infostealer logins opened Snowflake accounts that lacked MFA
Visual published by raw.githubusercontent.com, shown for identification of the record.
raw.githubusercontent.com ↗PLATE 080 / source-published visual
A CrowdStrike content update crashed machines without any attacker
Visual published with the cited source, shown for identification of the record.
crowdstrike.com ↗PLATE 081 / sourced visual
A pathology supplier's ransomware outage postponed NHS procedures
Visual published by medtechnews.uk, shown for identification of the record.
medtechnews.uk ↗PLATE 082 / source-published visual
Three NIST standards turned post-quantum cryptography into a migration
Visual published with the cited source, shown for identification of the record.
nist.gov ↗PLATE 083 / source-published visual
Agencies said a state actor pre-positioned inside US utilities
Visual published with the cited source, shown for identification of the record.
cisa.gov ↗PLATE 084 / sourced visual
A help desk call became the way into three UK retailers in 2025
Visual published by ncsc.gov.uk, shown for identification of the record.
ncsc.gov.uk ↗PLATE 085 / sourced visual
Stolen chatbot tokens turned a sales tool into a data pipeline
Visual published by miro.medium.com, shown for identification of the record.
miro.medium.com ↗PLATE 086 / sourced visual
F5 disclosed a long intrusion into its own development systems
Visual published by cisa.gov, shown for identification of the record.
cisa.gov ↗PLATE 087 / sourced visual
A prolonged JLR shutdown led the UK to guarantee a commercial loan
Visual published by d9s1543upwp3n.cloudfront.net, shown for identification of the record.
d9s1543upwp3n.cloudfront.net ↗PLATE 088 / source-published visual
A worm used stolen maintainer tokens to republish itself on npm
Visual published with the cited source, shown for identification of the record.
github.blog ↗PLATE 089 / source-published visual
A patched SharePoint flaw was bypassed before every version got a fix
Visual published with the cited source, shown for identification of the record.
microsoft.com ↗PLATE 090 / sourced visual
The 2025 cybersecurity order dropped attestation and identity duties
Visual published by bidenwhitehouse.archives.gov, shown for identification of the record.
bidenwhitehouse.archives.gov ↗PLATE 091 / sourced visual
A 2015 information-sharing law's liability shield briefly lapsed
Visual published by saratogacountyny.gov, shown for identification of the record.
saratogacountyny.gov ↗PLATE 092 / sourced visual
The SEC sued SolarWinds and its security chief, then dropped the case
Visual published by aitnews.com, shown for identification of the record.
aitnews.com ↗PLATE 093 / sourced visual
A second Operation Endgame sweep seized hundreds of servers
Visual published by justice.gov, shown for identification of the record.
justice.gov ↗PLATE 094 / sourced visual
The EU's NIS2 directive widened cyber duties and made managers liable
Visual published by pablosec.com, shown for identification of the record.
pablosec.com ↗PLATE 095 / sourced visual
DORA made financial firms directly responsible for ICT risk
Visual published by snabfinance.com, shown for identification of the record.
snabfinance.com ↗PLATE 096 / sourced visual
The Cyber Resilience Act ties EU market access to vulnerability reporting
Visual published by ferner-alsdorf.de, shown for identification of the record.
ferner-alsdorf.de ↗PLATE 097 / sourced visual
A 2026 OMB memo rescinded the federal software attestation mandate
Visual published by cdn.nextgov.com, shown for identification of the record.
cdn.nextgov.com ↗PLATE 098 / source-published visual
CISA replaced flat vulnerability deadlines with risk-tiered timelines
Visual published with the cited source, shown for identification of the record.
cisa.gov ↗PLATE 099 / sourced visual
The 2026 cyber strategy dropped the 2023 push for software liability
Visual published by epic.es, shown for identification of the record.
epic.es ↗PLATE 100 / sourced visual
Stryker's own disclosures never confirmed the wiper outsiders reported
Visual published by i.ytimg.com, shown for identification of the record.
i.ytimg.com ↗PLATE 101 / sourced visual
Attackers turned two open-source security scanners into supply chains
Visual published by cyberdeutsch.news, shown for identification of the record.
cyberdeutsch.news ↗PLATE 102 / sourced visual
DHS disbanded the Cyber Safety Review Board mid-review in 2025
Visual published by thecyberpost.com, shown for identification of the record.
thecyberpost.com ↗PLATE 103 / sourced visual
Google closed its record $32 billion Wiz deal after a year of review
Visual published by thenewswire.in, shown for identification of the record.
thenewswire.in ↗PLATE 104 / sourced visual
CIS Controls v8 organised safeguards by implementation group, not device
Visual published by jamestsaitwstorage.blob.core.windows.net, shown for identification of the record.
jamestsaitwstorage.blob.core.windows.net ↗PLATE 105 / sourced visual
OWASP's 2021 list put broken access control at the top of web risks
Visual published by miro.medium.com, shown for identification of the record.
miro.medium.com ↗PLATE 106 / source-published visual
MITRE's ATT&CK evaluations publish results without vendor scores
Visual published with the cited source, shown for identification of the record.
miro.medium.com ↗PLATE 107 / source-published visual
IBM's breach cost figure is a vendor estimate, not an audited total
Visual published with the cited source, shown for identification of the record.
ibm.com ↗PLATE 108 / sourced visual
The FBI's 2024 cybercrime total counts complaints, not incidents
Visual published by fbi.gov, shown for identification of the record.
fbi.gov ↗PLATE 109 / sourced visual
No More Ransom gave victims a free alternative before paying
Visual published by ismg-cdn.nyc3.cdn.digitaloceanspaces.com, shown for identification of the record.
ismg-cdn.nyc3.cdn.digitaloceanspaces.com ↗PLATE 110 / sourced visual
Verizon's 2026 breach report found more third parties involved
Visual published by ui.prt.news, shown for identification of the record.
ui.prt.news ↗PLATE 111 / sourced visual
Ransomware payment data disagrees because it measures different things
Visual published by bleepstatic.com, shown for identification of the record.
bleepstatic.com ↗PLATE 112 / sourced visual
FireEye disclosed the theft of its own attack-simulation tools
Visual published by investors.com, shown for identification of the record.
investors.com ↗PLATE 113 / sourced visual
Reused passwords let one credential-stuffing attack reach millions
Visual published by blogger.googleusercontent.com, shown for identification of the record.
blogger.googleusercontent.com ↗PLATE 114 / sourced visual
Microsoft answered nation-state intrusions with an engineering pledge
Visual published by tecniverse.com, shown for identification of the record.
tecniverse.com ↗PLATE 115 / sourced visual
Federal guidance dropped forced password changes and complexity rules
Visual published by pages.nist.gov, shown for identification of the record.
pages.nist.gov ↗PLATE 116 / sourced visual
NIST rewrote incident response guidance around the Cybersecurity Framework
Visual published by nist.gov, shown for identification of the record.
nist.gov ↗PLATE 117 / sourced visual
NIST's 2025 identity guidance drew a line around syncable passkeys
Visual published by pages.nist.gov, shown for identification of the record.
pages.nist.gov ↗No matching images. Try a case name or source.