In 2022, teenagers breached Microsoft, Okta, Uber and dozens more without any 0 day vulns. Leveraging the Cyber Safety Review Board's report and public sources, we'll explore how these attacks worked, how the playbook has outlived the group, and how to defend against these techniques.