Author: HackWatchit

The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions. Heleket’s support agent on Telegram claims, despite all evidence to the contrary, that it is not affiliated with Cryptomus. Image: Richard Sanders. On October 8, the U.K. issued sanctions (PDF) against Cryptomus — previously known as Certa Payments and Xeltox Enterprises — for processing payments that benefit the Russian government and its financial institutions. The sanctions freeze any Cryptomus…

While “digital forensics” and “incident response” often appear together (as in the acronym “DFIR”), they represent two distinct disciplines.What’s in a Name?The American Heritage Dictionary defines forensics as “The use of science and technology to investigate and establish facts in criminal or civil courts of law.”Contrast this with IBM’s definition of incident response: “Incident response […] refers to an organization’s processes and technologies for detecting and responding to cyberthreats, security breaches or cyberattacks.” Note the absence of any reference to legal proceedings—it simply describes the process by which an organization detects, halts, and recovers from an incident.Legal ConsiderationsAlthough most incidents…

A Ukrainian man has been sentenced to 70 months in a US prison for his role in a series of ransomware attacks.36-year-old Artem Stryzhak became an affiliate of the Nefilim ransomware group around June 2021, receiving an 80% cut of the ransoms he managed to extort in attacks against hospitals, government organisations, law firms, and businesses around the world.The rest of the ransom would go to Nefilim’s administrators – including fellow Ukrainian Volodymyr Tymoshchuk, who was charged last year in relation to attacks against hundreds of corporate victims using the LockerGoga and MegaCortex ransomware, as well as Nefilim.At the time…

Cybersecurity researchers at AIR Research Lab have discovered SolanaCry, a new malware delivered through a fake GitHub repository posing as a Solana starter kit. The repository can appear in AI coding agents‘ search results, leading them to follow instructions that install remote-access malware on developers’ Windows machines and potentially expose cryptocurrency wallets stored on those systems. Malicious GitHub Repository Delivers NetSupport RAT Rather than tricking developers into installing malicious software themselves, the attack targets AI agents through a malicious GitHub repository, SolanaUpdateTools/solana-starter-kit. Presented as an “open-source Solana dApp template with Anchor program, TypeScript client, and Next.js UI,” the repository was…

Topic: Governance, Risk, and Compliance in Action: Proving Security Outcomes Watch Now Abstract: Governance, Risk, and Compliance (GRC) is increasingly moving beyond policies, frameworks, and compliance checklists toward demonstrating measurable security outcomes. For security leaders, the challenge is no longer simply proving that controls exist, but demonstrating that they are effective, risks are understood, and investments are delivering tangible improvements in organizational resilience. The current webinar explores how organizations can transform GRC from a compliance-driven function into a strategic capability for measuring and communicating security outcomes. It will examine how security teams can connect governance requirements, risk assessments, control effectiveness,…

Palo Alto Networks announces that Unit 42® Continuous Frontier AI Defense and Prisma AIRS™ are now on the newly launched OpenAI Marketplace, making them directly available to OpenAI’s enterprise customers. Threat actors are deploying artificial intelligence to find and exploit vulnerabilities at unprecedented speed, compressing breach cycles by almost 97%—from weeks down to mere hours. Human-speed defense can no longer keep pace with adversaries executing automated, continuous attacks. AI Investments: The OpenAI Marketplace Advantage For enterprise organizations holding OpenAI spend commitments, this milestone offers a compelling 2-for-1 financial and strategic advantage. Security teams can now deploy machine-speed, proactive defense while retiring…

Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries Pierluigi Paganini October 30, 2026 Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus. The projects look convincing and run on real GitHub infrastructure, which helps them seem legitimate to potential…

Every organization has a different threat profile. Industry, geography, infrastructure, business operations, and the broader technology ecosystem all influence which adversaries and threats matter most. The challenge is putting threat intelligence to work at scale to identify the greatest threats to each business. The intelligence that security teams rely on is as varied as the threats they face. Organizations draw from commercial threat intelligence providers, industry information sharing and analysis centers (ISACs), government sources, open-source research, trusted partners, and indicators uncovered through their own threat hunting and incident response efforts.  Modern security operations need a “Bring your own intelligence” strategy…

“When it comes to cyber operations, we want to use modeling and simulation to help our cyber operators cut through the Fog of Cyberwar,” said Greg Touhill.