Author: HackWatchit

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Internet Exposure Reduction Guidance to help organizations address overlooked risks. CISA warns that misconfigured systems, default credentials, and outdated software are often publicly accessible via internet search and discovery tools, leaving critical vulnerabilities exposed and easily exploited by attackers. The document provides resources and recommendations to help organizations identify and mitigate these exposures. By following CISA’s Internet Exposure Reduction Guidance, organizations can proactively identify and remove these exposures, reducing their online footprint and strengthening their cybersecurity posture. Recognizing that the range and number of internet-accessible assets, including industrial internet of things…

A bizarre case of political impersonation, where Trump’s top aide Susie Wiles is cloned (digitally, not biologically — we think), and high-ranking Republicans start getting invitations to link up with “her” on Telegram to share their Trump pardon wishlists. Was it a deepfake? Or just someone with a halfway decent impression and access to a shady data broker? Meanwhile, we take a worryingly familiar journey into the mental health crisis in the UK — and how TikTok is stepping in with advice like “eat an orange in the shower” to cure your anxiety. Spoiler: it won’t. But it might make…

Beau Bullock // Overview HostRecon is a tool I wrote in PowerShell to assist with quickly enumerating a number of items that I would typically check after gaining access to a system. It can assist in providing situational awareness to a penetration tester during the reconnaissance phase of an engagement. It gathers information about the local system, users, and domain information. Probably the most important thing about it is that it does not use any ‘net’, ‘ipconfig’, ‘whoami’, ‘netstat’, or other system commands. I’ve had some security products alert on the use of those common commands/tools. Instead, those commands have…

The Defense Department is closing in on some promised reforms to its Risk Management Framework. By the end of July, officials expect to release a draft outline of a simpler, reworked process for industry feedback. Among the objectives: Eliminate redundancies in the system and make it more realistic to conduct ongoing, real-time security assessments instead of just point-in-time ones. The forthcoming request for information is the latest step forward in what acting DoD Chief Information Officer Katie Arrington has called a plan to “blow up” the Risk Management Framework, the approach the department has been using since 2018 to assess…

Cofense Intelligence uncovers a surge in ClickFix email scams impersonating Booking.com, delivering RATs and info-stealers. Learn how these sophisticated attacks trick users into running malware and what to watch out for. Cybersecurity experts at Cofense Intelligence are warning hotel chains and other businesses in the food and accommodation sector about an email scam that mimics Booking.com. These deceptive emails are part of attack campaigns known as ClickFix, which aims to trick users into running malicious software. The ClickFix campaign has been steadily gaining traction since November 2024, with a notable acceleration in recent months. According to Cofense’s analysis, a staggering…

Play ransomware group hit 900 organizations since 2022 Pierluigi Paganini June 06, 2025 A joint advisory from the US and Australian authorities states that Play ransomware has hit approximately 900 organizations over the past three years. A joint advisory from the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) states that Play ransomware has hit approximately 900 organizations over the past three years. The Play ransomware group has been active since June 2022, the list of victims includes the City of Oakland, the Cloud services provider Rackspace, and the Dutch…

Approximately 145 darknet and conventional internet domains, along with cryptocurrency funds linked to the BidenCash marketplace, have been seized by the U.S. Attorney’s Office for the Eastern District of Virginia. The operators of the BidenCash marketplace use the platform to simplify the process of buying and selling stolen credit cards and associated personal information. BidenCash seized after $17 million in illicit sales BidenCash commenced operations in March 2022. BidenCash administrators charged a fee for every transaction conducted on the website. The BidenCash marketplace had grown to support over 117,000 customers, facilitated the trafficking of over 15 million payment card numbers…

Internet-facing assets are targeted for many reasons, such as to establish persistence, evade defensive capabilities, and access sensitive networks. According to the search engine Shodan, approximately 1,600 VMware vSphere instances are directly accessible via the internet, representing a significant attack surface. Defending them is critical: A compromised vCenter instance can lead to full control over an organization’s virtual infrastructure, potentially impacting business continuity, data confidentiality, and overall security posture. Past events underscore the urgency of securing vCenter instances. In January 2024, VMware confirmed that a critical vCenter Server remote code execution vulnerability (CVE-2023-34048), patched in October 2023, was under active…

Can Cardano Finally Go Cross-Chain? For years, Cardano has been notably absent from the broader web of decentralized cross-chain infrastructure. While chains like Ethereum, Polygon, and Avalanche have become deeply integrated through decentralized bridges, Cardano’s design choices, while innovative, have complicated such connections. Why has it taken this long? And what changes with Apex Fusion’s launch? On June 5, Apex Fusion, in collaboration with development company Ethernal, launched two bridging technologies, Reactor and Skyline, intended to directly address the technical obstacles preventing Cardano from participating in permissionless, decentralized interoperability. These protocols mark the first significant attempt at creating a native,…