Author: HackWatchit

Researchers from SentinelOne have linked the PurpleHaze and ShadowPad activity clusters to China-aligned threat actors with high confidence. Some PurpleHaze intrusions are tentatively associated with groups overlapping the suspected Chinese cyberespionage teams known as APT15 and UNC5174. The latest investigation zeroes in on the specific subset of these threats that have targeted SentinelOne and other entities, and are attributed to China-nexus operations. “A thorough investigation of SentinelOne’s infrastructure, software, and hardware assets confirmed that the attackers were unsuccessful and SentinelOne was not compromised by any of these activities,” Aleksandar Milenkoski and Tom Hegel wrote in a Monday SentinelLABS post.  They…

How Do Digital Collectibles Gain New Purpose in Virtual Worlds? The evolution of digital ownership and interaction in virtual environments continues to accelerate. A recent collaboration announced between My Neighbor Alice, a multiplayer builder game built on blockchain technology, and Pudgy Penguins, a prominent non-fungible token (NFT) brand, illustrates this progression. This partnership introduces “Pudgy Land” within My Neighbor Alice, a development that integrates Pudgy Penguins’ digital assets into an interactive 3D gaming experience and signals a notable step for cross-chain interoperability. This initiative is designed to allow holders of Pudgy Penguins NFTs to utilize their digital assets in a…

DoD adapts modern authentication frameworks to meet evolving cyber threats The need for changes from the traditional model stem from audits that exposed critical vulnerabilities in federal systems. Michele Sandiford June 10, 2025 3:37 pm 4 min read As cyber threats against federal systems continue to grow, the Department of Defense’s enterprise Identity Credential and Access Management initiative is emerging as a model for how federal agencies are moving from traditional security models to modern authentication frameworks to meet the current threats. The need for changes from the traditional model stem from audits that exposed critical vulnerabilities in federal systems.…

For years, security leaders have been stuck in a reporting loop: patch volumes, CVSS scores, and red-yellow-green dashboards. These are useful… until they hit the boardroom. That’s when things fall apart. “What does a CVSS score of 9.8 mean for our revenue?” “How exposed are we to real-world loss?” “How much should we budget for cyber risk next year?” Vague answers don’t cut it anymore. *** This is a Security Bloggers Network syndicated blog from Blog – Balbix authored by Jagdish Upadhyay. Read the original post at: https://www.balbix.com/blog/ai-is-redefining-cyber-risk-quantification-heres-what-every-ciso-needs-to-know/

Hunter recently graduated with his Master’s degree in Cyber Defense and has over two years of experience in penetration testing. His favorite area of testing is Active Directory, and in his free time, he enjoys working in his home lab and analyzing malware. This blog has been cross-posted. We’re grateful to Hunter for allowing us to share this insightful work—you can check out the original post HERE. TL;DR If you only have access to a valid machine hash, you can leverage the Kerberos S4U2Self proxy for local privilege escalation, which allows reopening and expanding potential local-to-domain pivoting paths, such as…

Ransomware attacks are no longer just a cybersecurity concern – they are a direct threat to national security. A recent study found that among organizations hit by ransomware in the past 12 months, an average of 25 percent of critical systems were affected, with downtime lasting an average of 12 hours. The Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and the Multi-State Information Sharing and Analysis Center have sounded this alarm and recently issued a joint cybersecurity advisory, warning that ransomware groups are exploiting vulnerabilities in aging systems, including in the critical infrastructure sector. Such attacks don’t just threaten individual…

times preventing you from implementing Bayesian models in production? You’re not alone. While Bayesian models offer a powerful tool for incorporating prior knowledge and uncertainty quantification, their adoption in industry has been limited by one critical factor: traditional inference methods are extremely slow, especially when scaled to high-dimensional spaces. In this guide, I’ll show you how to accelerate your Bayesian inference by up to 10,000 times using multi-GPU Stochastic Variational Inference (SVI) compared to CPU-based Markov Chain Monte Carlo (MCMC) methods. What You’ll Learn: Differences between Monte Carlo and Variational Inference approaches. How to implement data parallelism across multiple GPUs.…

An international cybercrime operation coordinated by INTERPOL has led to the takedown of more than 20,000 malicious IPs and domains used to deploy infostealer malware across the Asia-Pacific region. Dubbed Operation Secure, the four-month crackdown (January to April 2025) brought together law enforcement from 26 countries and private cybersecurity partners to disrupt a growing cybercriminal infrastructure built around data-stealing malware. The effort also led to 32 arrests, 41 server seizures and the collection of over 100 GB of criminal data. A Clear Target: Infostealers Infostealer malware has become a go-to tool for cybercriminals seeking quick access to personal and corporate…

A coordinated campaign of brute-force attacks using hundreds of unique IP addresses targets Apache Tomcat Manager interfaces exposed online. Tomcat is a popular open-source web server widely used by large enterprises and SaaS providers, while Tomcat Manager is a web-based administration tool that comes bundled with the Tomcat server and helps admins manage deployed web apps via a graphical interface. Tomcat Manager is configured by default to only allow access from localhost (127.0.0.1), with no pre-configured credentials and remote access blocked. However, when exposed online, the web app can be targeted by attackers, as cybersecurity company GreyNoise observed recently. Starting June 5th, GreyNoise analysts discovered two coordinated campaigns targeting Apache…