Author: HackWatchit

Derek Banks // ADVISORY: The techniques and tools referenced within this blog post may be outdated and do not apply to current situations. However, there is still potential for this blog entry to be used as an opportunity to learn and to possibly update or integrate into modern tools and techniques. John’s hating on threat intelligence feeds post got me thinking.  As a former blue team member that is now solidly purple team, I do not hate threat intelligence (sorry, John).  But, I am not going to disagree with John’s take (and not just because he signs my paychecks), because he’s…

So, you think hacking is just about stealing information, extorting ransoms, or wiping out company data? The truth is, sometimes it’s about killing people too… A criminal cartel hired a hacker to identify “people of interest” (including the FBI’s Assistant Legal Attache), going in and and out of the US embassy in Mexico city, and then spy on calls made and received by their phones, and their location. It gets worse.. “According to the FBI, the hacker also used Mexico City’s camera system to follow the [FBI’s legal attache] through the city and identify people they met with… the cartel…

U.S. CISA adds TeleMessage TM SGNL flaws to its Known Exploited Vulnerabilities catalog Pierluigi Paganini July 02, 2025 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds TeleMessage TM SGNL flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added TeleMessage TM SGNL flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: CVE-2025-48927 (CVSS score of 5.3) TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability CVE-2025-48928 (CVSS score of 4.0) TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability CVE-2025-48927 is an Initialization…

Scammers are exploiting Microsoft 365 Direct Send to spoof internal emails targeting US firms bypassing security filters with phishing attacks using fake voicemails and QR codes. Cyber security researchers at Varonis Threat Labs have exposed a sophisticated new phishing campaign that exploits a little-known feature within Microsoft 365 to deliver malicious emails. This attack, which started in May 2025 and has been consistently active, has already targeted over 70 organizations, with a significant majority, 95%, being US-based organizations. The unique aspect of this campaign is its ability to “spoof internal users without ever needing to compromise an account,” making it…

all the time: “What projects should I do to get a job in data science or machine learning?” This question is flawed from the beginning. A great project is personal to you, which means any project I suggest will automatically be a “bad” choice. In this article, I aim to break down the types of projects that actually help you get hired and the framework you can follow to find them. 4–5 simple projects Start by building 4–5 smaller projects to give your portfolio some initial weight. The primary goal here is mainly for “optics” and to ensure that your resume/CV,…

Joff Thyer // This post is cross-posted from Packet Header on 3/1/16. __________   On Security Weekly Episode 452, I presented a technical segment on how to build your own small office/home office wired router. This blog post will list of the essential components, and expand upon the technical segment. Our goal is to build a multi-segment wired router that performs Network Address Translation (NAT) with IPv4, runs Internet Software Consortium (ISC) Bind9 for domain name service, and ISC DHCP services to deliver IP addresses on the inside of your network.   NOTE: Supporting configuration files associated with this blog…

The healthcare sector continues to be a prime target for cyber adversaries, with threat actors constantly evolving their tactics to exploit vulnerabilities. Over the past year, CrowdStrike Services responded to a growing number of financially motivated attacks aimed at encrypting data and extorting victims across the healthcare ecosystem. Notably, the tactics and techniques employed by threat actors have been unusually consistent across various healthcare entities, including hospitals, pharmaceutical companies, health insurance firms, and patient clinics. This blog explores CrowdStrike’s frontline observations across multiple incidents, the unique risks facing healthcare organizations, the adversary tradecraft we’ve seen, and practical steps to strengthen…

Australian airline Qantas disclosed that it detected a cyberattack on Monday after threat actors gained access to a third-party platform containing customer data. Qantas is Australia’s largest airline, operating domestic and international flights across six continents and employing around 24,000 people. In a press release issued Monday night, the airline states that the attack has been contained, but a “significant” amount of data is believed to have been stolen. The breach began after a threat actor targeted a Qantas call centre and gained access to a third-party customer servicing platform. “On Monday, we detected unusual activity on a third party…

A comprehensive response to recent data breaches and a roadmap for digital sovereignty The Wake-Up Call – Recent Cybersecurity Breaches in Tonga The recent leak of patient information online has sent shockwaves through Tonga’s government and healthcare systems, highlighting a critical vulnerability that threatens not just individual privacy, but national security itself. When hackers can access sensitive patient data and potentially disrupt essential services, it becomes clear that Tonga’s current digital infrastructure is inadequately prepared for modern cyber threats. This breach represents more than just a technical failure, it’s a symptom of a fundamental problem with centralized, vulnerable systems that…