Sequretek

Some gave everything so the rest of us could have something worth protecting.

On Memorial Day, we remember them with lasting gratitude.

One arrest. One breach. Both happened this week, and both have lessons your team needs to hear.

Good News:Authorities in the U.S. and Canada arrested the 23-year-old behind KimWolf, a DDoS-for-hire botnet that infected over one million IoT devices and recorded attack traffic of nearly 30 terabits per second. The operator, known online as "Dort," issued more than 25,000 attack commands before being caught. The arrest is part of a broader international operation that began disrupting the network back in March 2026.

Source: https://www.helpnetsecurity.com/2026/05/22/kimwolf-ddos-botnet-administrator-arrested/

Bad News: GitHub lost approximately 3,800 internal source code repositories after a developer installed a backdoored VS Code extension. The malicious update was live for just 18 minutes, but that was enough for TeamPCP's worm to scrape credentials from CI/CD runner memory and exfiltrate the data. It's now listed on BreachForums for $50,000. The same worm has compromised OpenAI, Grafana, Mistral AI, and the European Commission.

Source: https://www.techtimes.com/articles/317057/20260523/500-poisoned-packages-hundreds-companies-teampcps-worm-just-reached-github.htm

What This Means for All of Us: Rotate your CI/CD tokens now. Short-lived, scoped credentials stop worms like this one from spreading. Long-lived tokens sitting in runner memory are the vulnerability.

Share this with your IT team. Then ask them when they last audited your pipeline credentials.