The email was sent via Amazon SES carrying a genuinely valid hpe.com DKIM signature and passed SPF/DKIM/DMARC, so Gmail could not block it. Includes timeline, technical analysis, IOCs, response and law-enforcement paths, with bilingual PDF reports and email evidence screenshots.

2026-08-26 · 6 min

02Security

Related CVE Collection

A collection of CVEs that are directly related or belong to the same attack family (invalid curve / twist attacks), useful for cross-referencing and triage.

2024-10-10 · 4 min

03Security

Invalid Curve Attack & CRT Private Key Recovery

A deep dive into how JavaScript ECC libraries missing public-key curve validation leak private-key remainders through small-order subgroups, then reconstruct the full key via the Chinese Remainder Theorem (CRT).

2024-10-02 · 7 min

04Security

CVE-2024-48930 — secp256k1 (npm) ECDH Private Key Extraction

Discusses the vulnerability mechanism, impact scope and upgrade guidance for private-key extraction in the secp256k1 package under ECDH scenarios.

2024-09-25 · 4 min

05Security

CVE-2020-28498 — elliptic (npm) ECDH Invalid Curve Attack

Breaks down the private-key leakage risk in the elliptic library caused by missing invalid-curve validation in ECDH, along with the corresponding fix and mitigations.

2020-06-15 · 2 min

06Security

CVE-2017-16007 — node-jose (npm) ECDH-ES Invalid Curve Attack

Analyzes the node-jose vulnerability where the peer's public-key curve is not validated during ECDH-ES key agreement, allowing an attacker to recover the shared secret.

2017-05-08 · 2 min