Author: HackWatchit
The Czech Republic says the Chinese-backed APT31 hacking group was behind cyberattacks targeting the country’s Ministry of Foreign Affairs and critical infrastructure organizations. “The malicious activity, which lasted from 2022 and affected an institution designated as Czech critical infrastructure, was perpetrated by the cyberespionage actor APT31 that is publicly associated with the Ministry of State Security,” the Czech government said. “The Government of the Czech Republic strongly condemns this malicious cyber campaign against its critical infrastructure. Such behavior undermines the credibility of the People’s Republic of China and contradicts its public declarations.” European Union member states and NATO allies condemned…
New PumaBot targets Linux IoT surveillance devices Pierluigi Paganini May 28, 2025 PumaBot targets Linux IoT devices, using SSH brute-force attacks to steal credentials, spread malware, and mine crypto. Darktrace researchers discovered a new botnet called PumaBot targets Linux-based IoT devices, using SSH brute-force attacks to steal credentials, spread malware, and mine cryptocurrency. PumaBot skips broad internet scans and instead pulls a list of targets from its C2 server to brute-force SSH logins. Once in, it runs remote commands and sets up persistence by creating system service files. Researchers analyzed its core features and related binaries to better understand the…
“At best, these attacks cause disruption and financial loss. At worst, they undermine trust in the health systems on which people depend, and even cause patient harm and death.” – Tedros Adhanom Ghebreyesus, World Health Organization Director-Generali Introduction U.S. military service members, retirees, and their dependents deserve the highest quality of health care for their service and support to the nation. Whether they are seeking care for pregnancy, service-related injuries, or Individual Medical Readiness (IMR)ii requirements, there should never be a delay in care like those experienced in recent years. The Defense Health Agency (DHA) has a responsibility to serve and protect…
Chris has been working in security for 30 years, mainly doing penetration testing in both consulting and corporate environments. Chris is the author of the Nikto web scanner, founder of the RVAsec conference, and has been involved in many OSS projects and community efforts. Espanso is a powerful cross-platform and open-source text replacement (or text expander) tool. At a simple level: it replaces what you type with something else. For example, imagine typing three characters and having your full email address magically appear? Microsoft Word’s autocorrect and smart completion on phones can do a few of these things, but with…
PlainID introduced Policy Management for Agentic AI. Securing the future with a solution that brings identity-aware, policy-based access control to the next generation of AI systems. As organizations adopt AI and LLM-based systems, they are ingesting and processing vast amounts of sensitive, and high-risk data. Organizations are exposed to: Data leaks and compliance violations (e.g., PII, IP, regulated content) Regulatory and reputational risks from misused or exposed data Inability to ensure auditability and accountability in AI-driven decisions Delays in AI adoption due to governance bottlenecks and misalignment between security and engineering teams “As enterprises accelerate AI initiatives, PlainID empowers teams to govern AI data and…
CrowdStrike Named a Customers’ Choice in 2025 Gartner® Voice of the Customer for Endpoint Protection Platforms Report
An Italian tourist’s barefoot dash onto a SoHo sidewalk has cracked open one of the most violent crypto-ransom plots ever seen in New York City.With the surrender of William Duplessie, 32, on Tuesday, police say they have now charged two business partners who allegedly imprisoned and tortured the 28-year-old for 17 days in a luxury townhouse to force access to his multimillion-dollar Bitcoin wallet.A townhouse turned torture chamberDetectives describe an eight-bedroom home on Prince Street rented for up to $40,000 a month. Inside, the victim was allegedly hung over a roof ledge, shocked with electrical wires, and menaced with a…
This week we went down to Phoenix Arizona where we teamed up with the Arizona Cyber Warfare Range (AZCWR) for a great event at Grand Canyon University! Black Hills Information Security feels passionate about giving back to the community by offering lots of free education. Our blog is a gold mine of tools, tips, tricks, techniques and ideas for pentesting, and red and blue teaming. We offer several webcasts a month with more in-depth ideas and topics about infosec; these also make a great library of videos on our YouTube channel. So it was a perfect fit for us to team up…
ANY.RUN analysts recently uncovered a stealthy phishing campaign delivering the Remcos RAT (Remote Access Trojan) through a loader malware known as DBatLoader. This attack chain relies on a blend of obfuscated scripts, User Account Control (UAC) bypass, and LOLBAS (Living-Off-the-Land Binaries and Scripts) abuse to stay hidden from traditional detection methods. What makes this campaign particularly dangerous is its use of built-in Windows tools and trusted system processes to blend in with normal activity, making it much harder to catch through signatures alone. Let’s walk through the full infection chain and see how you can safely detect these techniques in…