Author: HackWatchit

The Army’s Unified Network Plan 2.0 (AUNP 2.0) represents a pivotal transformation in military networking and cybersecurity. Unlike its predecessor, which sought to unify disparate networks under a single framework, AUNP 2.0 acknowledges a fundamental reality: You cannot “unify” networks in the traditional sense. The mathematical and logistical challenges of merging infrastructure at scale make such an approach impractical. Instead, the Army is shifting its focus toward a zero trust, data-centric architecture, where security is built around the data itself rather than the network it resides in. This shift is not just a technological adjustment — it is a necessary…

Threat actors linked to lesser-known ransomware and malware projects now use AI tools as lures to infect unsuspecting victims with malicious payloads. This development follows a trend that has been growing since last year, starting with advanced threat actors using deepfake content generators to infect victims with malware. These lures have become widely adopted by info-stealer malware operators and ransomware operations attempting to breach corporate networks. Cisco Talos researchers have discovered that the same technique is now followed by smaller ransomware teams known as CyberLock, Lucky_Gh0$t, and a new malware named Numero. The malicious payloads are promoted via SEO poisoning and malvertising to…

Derek Banks, Beau Bullock, & Brian Fehrman // Our clients often ask how they could have detected and prevented the post-exploitation activities we used in their environment to gain elevated privileges and ultimately access sensitive data. Most of the time, this is achieved through credential abuse.   As pentesters, the primary condition we take advantage of in credential abuse is poor passwords. In any given environment with more than a few hundred end-users, it is almost guaranteed that someone has chosen the season and year (e.g. Summer2017) as their password. This makes it pretty easy to guess using a technique…

Topic: Threat Modeling for Cloud Security: Protecting Modern Infrastructures Watch Now Abstract: As organizations shift their important data and assets to the cloud, threat intelligence and analysis have become critical. Traditional security methods, which were designed for on-premises infrastructures, often fail to address the challenges of cloud and hybrid environments. In these settings, the shared responsibility model and service level agreements (SLAs) increase risk and complexity. To stay ahead, organizations must adopt a proactive, tailored approach to threat modeling that is specifically designed for the cloud. This webinar explores how to integrate threat modeling into cloud security to proactively identify…

When I began my career as a Special Agent with the Air Force Office of Special Investigations, I witnessed firsthand how policymakers initially approached national security issues related to cyberattacks. They often took an ‘as needed’ approach to incidents, like ransomware attacks, disrupted public infrastructure, or theft of intellectual property. Fast forward to today – heightened geopolitical tensions, accelerated digitalization, the rapid adoption of AI, and the ubiquity of remote work have exponentially expanded the attack surface. This isn’t just an evolution; we’ve been thrust into a new, demanding era of cyberwarfare. Consider this – Palo Alto Networks blocks up…

Microsoft is looking to streamline the software updating process for IT admins and users by providing a Windows-native update orchestration platform, and to help organizations upgrade their computer fleet to Windows 11 with the help of Windows Backup for Organizations. The software update orchestration platform “Today, line-of-business apps, Windows components, Visual Studio, and other products are updated independently,” says Microsoft Product Manager Angie Chen. “Updates across the Windows ecosystem can feel like a fragmented experience for IT admins managing applications that have their own update orchestrators (e.g., line of business) and commercial management tools that handle their own download, install,…

China-linked APT41 used Google Calendar as C2 to control its TOUGHPROGRESS malware Pierluigi Paganini May 29, 2025 Google says China-linked group APT41 controlled malware via Google Calendar to target governments through a hacked site. Google warns that China-linked APT41 used TOUGHPROGRESS malware with Google Calendar as C2, targeting various government entities via a compromised website. ” In late October 2024, GTIG discovered an exploited government website hosting malware being used to target multiple other government entities. The exploited site delivered a malware payload, which we have dubbed “TOUGHPROGRESS”, that took advantage of Google Calendar for command and control (C2).” reads the…

More than 90% of XRP’s supply is currently profitable, even though the token’s price has remained relatively flat for the past three months.Data from on-chain analytics firm Santiment reveals that most of XRP’s circulating supply was acquired at lower price points than its current market value.This level of profitability places XRP ahead of several major altcoins. For comparison, only 71.5% of Ethereum, 77.9% of Dogecoin, 71.0% of Cardano, and 80.5% of Chainlink holdings are in profit.However, XRP trails only Bitcoin, which leads with 98.4% of its circulating supply in the green.XRP Outpaces Other Altcoins’ Profitability (Source: Santiment)Analysts at Santiment explained…

 Volt Typhoon is a state-sponsored advanced persistent threat (APT) group, attributed to China, that’s been quietly targeting critical infrastructure — including energy, water, transportation and telecoms — since at least 2021. According to CISA’s advisory (AA24-038A), their tactics prioritize stealth over speed: Exploiting zero-day vulnerabilities, leveraging valid credentials and using “living-off-the-land” techniques like PowerShell and WMI to avoid detection. While the group’s known targets have been primarily in the U.S., the risk extends globally. In an interconnected infrastructure ecosystem, a breach in one region can quickly ripple across supply chains, affecting North America and Europe alike.  Combating modern identity-centric threats requires…