Documented cases attributed to hacktivist threat actors, sourced and fact-checked.
NINJIO's training account connects a badge surfer photographing passwords to the 2012 Saudi Aramco Shamoon attack. The sources reviewed here do not independently corroborate that physical-access claim. The destructive malware incident is documented, but its entry method and the training story must be kept separate.