Author: HackWatchit

David Fletcher // The following techniques serve to illustrate methods for obtaining C2 communication in a particular Cylance protected environment.  The configuration of the centralized infrastructure and the endpoint agents were not inspected prior to testing. The environment may exhibit configuration errors and may not conform with best practice for deployment of Cylance infrastructure. However, in our experience, misconfiguration is not uncommon and more times than not tends to have catastrophic results with regard to the overall security posture of an environment. This is the reason that we test deployments before accepting their stated protection levels at face value. In…

U.S. tax resolution firm Optima Tax Relief suffered a Chaos ransomware attack, with the threat actors now leaking data stolen from the company. Optima Tax Relief is a well-known U.S. tax resolution and settlement firm that helps individuals and businesses in addressing and fixing federal and state tax issues. The company claims to be the nation’s leading tax resolution firm, having resolved over $3 billion in tax liabilities for clients. Today, the Chaos ransomware gang added Optima Tax Relief to its data leak site, claiming to have stolen 69 GB of data.  Optima Tax Relief entry on Chaos data leak…

How would you like to earn yourself millions of dollars?Well, it may just be possible – if you have information which could help expose the identities of cybercriminals involved with the notorious RedLine information-stealing malware.The US Department of State is offering up to US$10 million for information about the government-backed hackers believed to be behind RedLine malware attacks, which have included US critical infrastructure among their targets.RedLine, which is one of the world’s most prolific information stealers in recent years, exfiltrates a wide variety of information including account details and passwords saved in browsers, cookies, and credit card details, as…

iVerify’s NICKNAME discovery reveals a zero-click iMessage flaw exploited in targeted attacks on US & EU high-value individuals including political figures, media pros and executives from AI companies. iVerify, a leading mobile EDR security platform, has revealed the discovery of a previously unknown zero-click vulnerability in Apple’s iMessage service. Dubbed NICKNAME, this flaw can compromise an iPhone without any user interaction, and it appears to be part of a sophisticated mobile spyware campaign, potentially backed by China, targeting important individuals in the US and Europe. According to iVerify’s report, shared with Hackread.com, they observed unusual activity on iPhones of prominent…

Singer-songwriter Jonathan Mann recently shared the story of how earning millions in Ethereum (ETH) during a one-hour sale of his NFTs eventually became a “tax nightmare.”Mann has published one song a day over the past 17 years and released his 6,000th song on June 5, which was about the purported nightmare resulting from the sale.In 2022, he sold 4,000 songs worth 13 years of work within 60 minutes for a total of roughly $3 million in Ethereum. He retained the earnings in Ethereum instead of converting to dollars. However, a week later, market price slipped below $3,000, shrinking the sale’s dollar…

What Role does Certainty Play in the Management of NHIs Lifecycle? Where data breaches and cyber-threats pose significant risks, any security professional worth their salt knows the importance of having robust and efficient management practices. NHIs lifecycle management serves as one of the cornerstones of modern cybersecurity efforts. It helps curtail these risks by providing a sense of certainty in an otherwise tumultuous data-laden landscape. So, what does certainty mean, and how is it achieved? The Need for Certainty in NHIs Lifecycle Management NHIs, or Non-Human Identities, form a crucial bridge between humans and machines in cyberspace. They act as…

Microsoft has been busy releasing more out-of-band (OOB) patches than usual throughout May. The May Patch Tuesday release of updates was typical in number of vulnerabilities addressed with 41 in both Windows 10 and 11, and their associated servers. They also did a great job finally fixing most of the reported issues that have been carried out for a while. But it appears something was not quite right, because there were some issues reported from the start and there’s been a lot of follow-up work. Patches In mid-May, Microsoft released KB5061768 for Windows 10 21H2 and 22H2 to address an…

Attackers exploit Fortinet flaws to deploy Qilin ransomware Pierluigi Paganini June 06, 2025 Qilin ransomware now exploits Fortinet vulnerabilities to achieve remote code execution on impacted devices. Threat intelligence firm PRODAFT warned that Qilin ransomware (aka Phantom Mantis) group targeted multiple organizations between May and June 2025 by exploiting multiple FortiGate vulnerabilities, including CVE-2024-21762, and CVE-2024-55591. “Phantom Mantis recently launched a coordinated intrusion campaign targeting multiple organizations between May and June 2025. Initial access are being achieved by exploiting multiple FortiGate vulnerabilities, including CVE-2024-21762, CVE-2024-55591, and others.” reads the report published by PRODAFT. 🚨 Threat actors are actively exploiting Fortigate…

For years, gray-market services known as “bulletproof” hosts have been a key tool for cybercriminals looking to anonymously maintain web infrastructure with no questions asked. But as global law enforcement scrambles to crack down on digital threats, they have developed strategies for getting customer information from these hosts and have increasingly targeted the people behind the services with indictments. At the cybercrime-focused conference Sleuthcon in in Arlington, Virginia, today, researcher Thibault Seret outlined how this shift has pushed both bulletproof hosting companies and criminal customers toward an alternative approach.Rather than relying on web hosts to find ways of operating outside…