Author: HackWatchit

While Citrix has observed some instances where CVE-2025-6543 has been exploited on vulnerable NetScaler networking appliances, the company still says that they don’t have evidence of exploitation for CVE-2025-5349 or CVE-2025-5777, both of which have been patched earlier this month. CVE-2025-5777, in particular, has captured the attention of infosec professionals due to its similarity to CVE-2023-4966, aka CitrixBleed. Consequently, CVE-2025-5777 has been informally dubbed “CitrixBleed 2” by security researcher Kevin Beaumont. Both CitrixBleed and CitrixBleed 2 allow remote unauthenticated attackers to read memory from NetScaler devices and potentially acquire sensitive active session tokens. They can then be used to hijack…

Sally Vandeven // ADVISORY: The techniques and tools referenced within this blog post may be outdated and do not apply to current situations. However, there is still potential for this blog entry to be used as an opportunity to learn and to possibly update or integrate into modern tools and techniques. Evading anti-virus scanners has become a bit of a sport around BHIS.  When we do C2 testing for our customers we start with a host on the internal network and create a reverse connection out to our C2 server.  We then proceed to send various types of data in…

Spanish police have arrested five people in connection with a “crypto investment fraud ring” that laundered almost $540 million (€460 million) in illicit profits from more than 5,000 victims.It followed a global investigation involving law enforcement from Spain, Estonia, France and the U.S that began in 2023.Three people were detained following searches on the Canary Islands, while a further two arrests were made in Madrid.A crypto specialist was deployed to Spain on the day of the raids, “contributing to the successful completion of the operation,” Europol said in a statement announcing the operation.The ringleaders allegedly used associates around the world…

Microsoft’s Threat Intelligence Center has released a new tool called RIFT to help malware analysts identify malicious code hidden in Rust binaries. While Rust is becoming more popular for its speed and memory safety, those same qualities make malware written in Rust harder to analyze. RIFT is designed to cut through that complexity and make the job easier. Overview of RIFT Static Analyzer (Source: Microsoft) Why Rust malware is hard to analyze To show the challenge, Microsoft ran a test. They wrote a simple downloader in C++ and in Rust. Both did the same work: download data and save it.…

Is the IRS finally going to pay down its tech debt? And move its infrastructure into the 2020s? Perhaps so, now that it has inked a deal with Cayosoft to replace its aging legacy solutions. The sprawling agency, the bane of taxpayers and legislators alike, has relied on using tools from a legacy vendor to manage Microsoft platforms, users and identities, Cayoso pointed out. But those tools stuttered for a common reason — they weren’t designed to work in cloud and hybrid environments. That forced the agency to foot the bill for costly customization just to keep up and running and avoid…

A data breach at Ahold Delhaize USA Services, LLC, a company providing support to the major East Coast grocery retailer Ahold Delhaize USA, has affected more than 2.2 million (2,242,521) individuals (including over 95,000 Mainers). The incident, which involved unauthorized access to internal US business systems, occurred between November 5th and 6th, 2024, leading to the theft of highly sensitive personal, financial, and health information primarily belonging to current and former employees. Ahold Delhaize USA is a prominent name in the US grocery sector, operating popular brands such as Food Lion, Giant Food, The GIANT Company, Hannaford, and Stop &…

Gartner projects that by 2028, organizations enriching their Security Operations Center (SOC) data with exposure insights will reduce the frequency and impact of cyberattacks by 50%. This bold forecast underscores a crucial shift: proactive exposure management is quickly becoming foundational to modern cyber defense. Why organizations struggle to prioritize what matters Security teams are responsible for defending an organization against looming cyber threats. Needless to say, they’re inundated with data from constantly expanding attack surfaces. But what are teams supposed to do with all? Addressing thousands of vulnerabilities is far from realistic. Enter the looming spiral of trying to pick…

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. The FBI warns that Scattered Spider is now targeting the airline sectorLapDogs: China-nexus hackers Hijack 1,000+ SOHO devices for espionageTaking over millions of developers exploiting an Open VSX Registry flawOneClik APT campaign targets energy sector with stealthy backdoorsAPT42 impersonates cyber professionals to phish Israeli academics and journalistsKai West, aka IntelBroker, indicted for cyberattacks causing $25M in damagesCisco fixed critical ISE flaws…

Cloudflare has implemented end-to-end encryption (E2EE) to its video calling app Orange Meets and open-sourced the solution for transparency. The application has been available since last year when the internet giant launched it as a demo for Cloudflare Calls (now Realtime). With the introduction of E2EE and the resolution of various trust and verification issues, users interested in strong cryptographic assurances can explore Orange Meets as a foundation for secure video calling in research or prototyping contexts. E2EE encryption design Orange Meets implements end-to-end encryption using Messaging Layer Security (MLS), an IETF-standardized group key exchange protocol. The Rust-based implementation of MLS…