Author: HackWatchit

Moral hazard ahoy: M&S head Archie Norman won’t say if he authorized DragonForce ransomware hacker payday. The post Did This Retail Giant Pay a Ransom to Scattered Spider? appeared first on Security Boulevard.

One thing I’ve learned as a developer is that skill doesn’t always show up on paper. I once worked on a small open-source bug that nobody else wanted to touch. It wasn’t glamorous, but it mattered. That fix ended up helping hundreds of users, yet it never made it onto my résumé. That’s the problem. Traditional résumés miss the real story — the invisible work, the learning, the persistence. So I started recording my work differently. Not in bullet points, but as contributions tied to real tasks, visible online.For a long time, I believed the standard way to apply for…

Iranian group Pay2Key.I2P ramps Up ransomware attacks against Israel and US with incentives for affiliates Pierluigi Paganini July 09, 2025 An Iranian ransomware group, Pay2Key.I2P, has intensified attacks on U.S. and Israeli targets, offering affiliates higher profits. The Iranian ransomware group Pay2Key.I2P is stepping up attacks on U.S. and Israeli targets, luring affiliates with higher profit shares. The ransomware gang is the successor to the original Pay2Key group and experts linked it to the Iran-nexus APT group Fox Kitten. Pay2Key.I2P now operates as a ransomware-as-a-service outfit. Since launching in February 2025, Pay2Key.I2P has grown fast, aided by promotion on Russian…

Dale spent over 20 years working as an enterprise defender before joining Black Hills Information Security as a penetration tester in 2020. One tool that I can’t live without when performing a penetration test in an Active Directory environment is called NetExec. Being able to efficiently authenticate against multiple systems in the network is crucial, and NetExec is an incredibly powerful tool that helps automate a lot of this activity. What is NetExec? NetExec is an open-source tool designed to conduct network reconnaissance, lateral movement, and security assessments as well as to help with automated authentication testing against remote systems…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday disclosed multiple hardware vulnerabilities in Emerson’s ValveLink products. The flaws include cleartext storage of sensitive data in memory, protection mechanism failure, uncontrolled search path elements, and improper input validation. All versions of Emerson’s ValveLink SOLO, DTM, PRM, and SNAP-ON released before version 14.0 are affected by the vulnerabilities. “Successful exploitation of these vulnerabilities could allow an attacker with access to the system to read sensitive information stored in cleartext, tamper with parameters, and run un-authorized code,” CISA detailed in its advisory.  Emerson reported these vulnerabilities to CISA. The agency noted…

It has been nearly 18 months since I started up my freelancing career — I can hardly believe it! When I first got started, I thought I had an idea of how things would evolve. In some ways I was right and in some ways I was wrong. You can read about the early days of my freelancing in my first and second posts on the subject. In those blog posts I was just starting out and getting my feet under me. I still had many questions and, in fact, said I would write a new post after some crucial…

Cyber criminals continue to innovate, with a recent innovation involving the hijacking of expired Discord vanity invite links to silently deliver malicious payloads. This new campaign, discovered by Check Point Research, delivers AsyncRAT, now ranked number 3 among Top Malware for June. Using trusted platforms such as GitHub, Bitbucket, and Discord for payload delivery and data exfiltration, the attackers have devised an advanced multi-stage malware delivery system, including ClickFix phishing tactics and ChromeKatz to bypass encryption mechanisms. These developments underscore the ever-evolving nature of cyber threats, with SafePay remaining a top ransomware threat and the education sector continuing to face…

  Terry Gerton All right, well, we’re going to talk about a DOJ rule. It is the rule on foreign adversary access to U.S. sensitive data. The rule was issued back in April. So just refresh our memories on what’s in the rule and what DOJ is trying to accomplish. Townsend Bourne So this rule, as you mentioned, it’s a DOJ rule, so we’re not talking about the FAR or DFARs here, so it’s little bit different than some of the rules we’ve talked about in the past. This rule stems from an executive order that came out years ago…

Executive Summary As organizations depend more on applications, devices and services to interact across hybrid environments, non-human identities are becoming more common. To enable secure access for these identities within the organization, Amazon Web Services (AWS) has introduced the AWS Identity and Access Management (IAM) Roles Anywhere service that allows workloads outside of AWS to authenticate using digital certificates instead of traditional access keys. The AWS IAM Roles Anywhere service offers organizations several security advantages and it is relatively simple to configure, especially for an organization that already has a public key infrastructure (PKI). Usually, implementation of this service requires…