Author: HackWatchit
In February 2025, our detection engines identified a SpyLoan application on a victim’s device. The detected sample belonging to the “RapiPlata” application, which was available on Google Play (GP) and downloaded by over 100K victims. We estimate that around 150K victims have downloaded the app from both the Google Play Store and the Apple App Store, further highlighting the scale of the threat. This detection was made possible by Harmony Mobile’s machine learning model, which flagged the app as malicious. Notably, “RapiPlata” achieved a Top 20 ranking in the finance category on SimilarWeb’s platform in Colombia, indicating significant user engagement.…
New Anubis RaaS includes a wiper module Pierluigi Paganini June 16, 2025 Anubis RaaS now includes a wiper module, permanently deleting files. Active since Dec 2024, it launched an affiliate program in Feb 2025. Anubis is a new RaaS that combines file encryption capability with a rare “wipe mode,” permanently deleting files and preventing recovery even after ransom payment. Anubis operates a flexible affiliate program that has been active since December 2024. Anubis breached organizations worldwide in multiple sectors, including healthcare and construction. “Anubis is a recently identified group that sets itself apart by partnering encryption with more destructive capabilities—wiping…
Email accounts of several Washington Post journalists were compromised in a cyberattack believed to have been carried out by a foreign government. The incident was discovered on Thursday evening and the publication started an investigation. On Sunday, June 15, an internal memo was sent to employees, informing them of a “possible targeted unauthorized intrusion into their email system.” According to The Wall Street Journal, the memo was signed by Executive Editor Matt Murray and informed that Microsoft accounts of a limited number of journalists were affected. Owned by Amazon founder Jeff Bezos, The Washington Post is one of the most influential…
Abstract Money laundering is a major financial crime that involves introducing illicitly obtained funds into legitimate financial systems to disguise their criminal origins. Beyond concealing criminal activity, laundered funds are frequently redirected to exert economic influence, finance organized crime, or destabilize regional and international systems. This paper examines the mechanisms through which illicit capital infiltrates legitimate businesses—particularly vulnerable small and medium-sized enterprises (SMEs)—and how such financial interference can precipitate economic crises. Once these businesses become dependent on illicit financing, any disruption in funding can lead to mass bankruptcies, widespread unemployment, and systemic socioeconomic decline. This analysis explores how money laundering…
One year ago, we wrote about Extended Detection and Response (XDR) as an emerging security category because there were inherent, unmet needs for organizations. Today, we see that Cisco has driven this market to achieve new heights and requirements with our approach to XDR. With over 1,000 customers, the true promise of XDR is being realized through: Focus on correlated incidents vs. investigating every security event Recognition for the importance of network and cloud telemetry Open, hybrid architectures supporting more than just native telemetry Cisco XDR democratizes security operations. As a comprehensive, standalone security tool for organizations it delivers built-in…
Brian King // ADVISORY: The techniques and tools referenced within this blog post may be outdated and do not apply to current situations. However, there is still potential for this blog entry to be used as an opportunity to learn and to possibly update or integrate into modern tools and techniques. News from Google this week says that Chrome will start enforcing Certificate Transparency a year from now. https://groups.google.com/a/chromium.org/forum/#!topic/ct-policy/78N3SMcqUGw This means that when Chrome contacts a website, if it finds that the certificate does not adhere to Transparency requirements, Chrome won’t load the page. They’re announcing it now so interested…
Cyolo announced several major new capabilities, headlined by Cyolo Third-Party VPN Control. This capability within the company’s Cyolo PRO (Privileged Remote Operations) solution delivers visibility and access control for enforced third-party VPN and direct connections without requiring changes to production infrastructure or vendor workflows. In today’s industrial environments, even organizations with mature security programs face a critical blind spot: third-party connections they cannot govern or even see. Some vendors insist on using their own legacy VPNs, site-to-site tunnels, or proprietary ‘black box’ gateways on OT networks, forcing plant managers and industrial operators to accommodate external methods that operate outside of…
Getting a call saying a family member has been kidnapped is terrifying. Fear and panic take over, making it hard to think clearly. That’s exactly what criminals count on when they use a scam called virtual kidnapping. What is virtual kidnapping? It’s emotional extortion where scammers claim a loved one has been abducted and demand ransom. Using AI-generated voices, social media details, and spoofed caller IDs, they make threats seem real and pressure victims to act quickly before verifying the truth. Real-life cases In Arizona, a mother received a call and heard what sounded exactly like her 15-year-old daughter crying…
Feeling mischievous this Halloween, I decided to have some fun with family. ….And by family, I mean John. I thought I might share a gem from the Strand hutch I dug up this summer. Meet John Strand – Maybe the Last, Lonely Innocent Clown __________ P.S. – I hope you enjoy because I’m actually going to be in serious trouble for this one. John’s going to be pissed. Here’s one for all the times I had to endure the “not touching you” game on car trips.