Author: HackWatchit

The Federal Criminal Police Office of Germany (Bundeskriminalamt or BKA) claims that Stern, the leader of the Trickbot and Conti cybercrime gangs, is a 36-year-old Russian named Vitaly Nikolaevich Kovalev. “The subject is suspected of having been the founder of the ‘Trickbot’ group, also known as ‘Wizard Spider,'” BKA said last week [English PDF], after another round of seizures and charges part of Operation Endgame, a joint global law enforcement action targeting malware infrastructure and the threat actors behind it. “The group used the Trickbot malware as well as other malware variants such as Bazarloader, SystemBC, IcedID, Ryuk, Conti and Diavol.”…

Kent Ickler // ADVISORY: The techniques and tools referenced within this blog post may be outdated and do not apply to current situations. However, there is still potential for this blog entry to be used as an opportunity to learn and to possibly update or integrate into modern tools and techniques. How to Configure Distributed Fail2Ban: Actionable Threat Feed Intelligence Fail2Ban is a system that monitors logs and triggers actions based on those logs. While actions can be very customized, the typical use case is monitoring an auth-log for authentication errors and configuring a system to block the offending source…

Two Linux flaws can lead to the disclosure of sensitive data Pierluigi Paganini May 31, 2025 Qualys warns of two information disclosure flaws in apport and systemd-coredump, the core dump handlers in Ubuntu, Red Hat Enterprise Linux, and Fedora distros. Researchers discovered a vulnerability in Apport (Ubuntu’s core dump handler) and another bug in systemd-coredump, which is used in the default configuration of Red Hat Enterprise Linux 9 and the Fedora distribution. systemd-coredump automatically captures “core dumps” (snapshots of a program’s memory), when an application crashes. These dumps can be saved or logged in the system journal, making it easier for developers to inspect them…

Fraudsters are winning the AI arms race, first-party fraud is rising, and siloed systems are holding back defenses, according to DataVisor. Their 2025 Fraud & AML Executive Report, based on surveys of banks, fintechs, credit unions, and digital platforms, outlines clear signals for CISOs trying to build resilient, forward-looking strategies. Fraudsters have the upper hand The most urgent issue? Criminals are using AI better than most organizations. Three in four respondents said fraudsters currently have the edge with generative AI, using it for deepfake scams, synthetic identities, and coordinated phishing. Only 12.5% of participants believe legitimate organizations benefit more than…

At Span Cyber Security Arena, I sat down with Ria Shetty, Director, Cyber Security & Resilience for Europe at Mastercard. Our conversation cut through the hype and focused on what CISOs deal with every day: how to embed security into innovation, manage supply chain risk, and prepare both systems and people for the threats ahead. For Shetty, the idea that innovation competes with security is a false choice. “They go hand in hand,” she says. User trust is central to her approach. “That’s the most valuable currency,” she explains. Lose it, and it’s hard to get back. That’s why transparency,…

The following is a guest post and analysis from Nanfeng Jie, Lead Product Manager at Trust Wallet.Over the past few years, we’ve seen a clear shift in how people interact with digital assets. More users are choosing self-custody as a deliberate move toward greater control and accountability. This trend is reflected in the rapid rise of tools like Trust Wallet, one of the most widely used self-custodial wallets in Web3.At Trust Wallet, we’ve seen firsthand how quickly expectations are evolving. Users want more than security — they want simplicity. That insight guided our decision to become one of the first…

Cybersecurity firm Quorum Cyber has uncovered two new versions of malicious software known as NodeSnake. This discovery highlights a possible shift in targets for the Interlock ransomware group, which is believed to be behind these attacks. Quorum Cyber’s Threat Intelligence team has been tracking NodeSnake and strongly believes it is connected to Interlock ransomware. This connection is based on the shared online infrastructure used by the attackers. The team noticed similar malicious code used in attacks on two universities in the United Kingdom within two months. The same attackers likely placed both NodeSnake RATs at these universities. Furthermore, the two…

John Strand // New to InfoSec? Mentoring someone new to the industry? Here’s John’s advice if he had to do it all over again. Sierra is on replying to your questions and comments.  We tried something new in the video and added some of these comments in pop-up video form, let us know if you like that. Join us live on the next webcast for our jokey pre-show chat and more fun q&a. Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_Your5YearPlanIntoInfoSec.pdf *John did this webcast again a year later and included some special guests. Check it out here: www.blackhillsinfosec.com/webcast-john-strands-5-year-plan-into-infosec-part-2/ We…

Can Your Team Truly Benefit from Robust IAM Practices? I’ve had the chance to observe how different teams tackle their security issues. That brings me to the question at hand: Can adopting robust IAM practices empower your team to improve their security management? Well, the simple answer is yes! Strong IAM practices have the capacity to transform the way your team manages security, particularly when it comes to Non-Human Identities (NHIs) and Secrets Security Management. The Role of NHIs in Today’s Secured Cloud Environment NHIs have become integral to cutting-edge cybersecurity strategies. We find that machine identities are no longer…