Author: HackWatchit

Chinese hackers have been exploiting a remote code execution flaw in Ivanti Endpoint Manager Mobile (EPMM) to breach high-profile organizations worldwide. The flaw is identified as CVE-2025-4428 and received a high-severity score. The issue can be leveraged to execute code remotely on Ivanti EPMM version 12.5.0.0 and earlier via specially crafted API requests. Ivanti disclosed the flaw together with an authentication bypass (CVE-2025-4427) and patched them both on May 13, 2025, noting that the two issues had been exploited previously against a “very limited number of customers.” Yesterday, EclecticIQ’s researcher Arda Büyükkaya reported seeing CVE-2025-4428 being exploited extensively in the wild since May 15, and…

A 19-year-old college student faces charges after pleading guilty to cyber extortion targeting PowerSchool, exposing data of 60 million+ students & 10 million teachers. Learn about the repercussions of this breach dubbed the largest in US schools’ history. A 19-year-old college student, Matthew D. Lane from Sterling, Massachusetts, has agreed to plead guilty in a cyber extortion case involving two US companies, including PowerSchool, a major education software provider. The US Department of Justice (DOJ) announced on May 20 that Lane, a student at Assumption University, is accused of hacking into computer networks and demanding ransom payments. According to the…

Since 1979, the Federal Emergency Management Agency (FEMA) has stood as the cornerstone of the United States’ disaster response and recovery framework. Established to coordinate federal assistance during emergencies, FEMA’s role has been pivotal in aiding state, local, tribal, and territorial (SLTT) governments in times of crisis. However, recent political discourse has raised questions about the agency’s future, with proposals suggesting a diminished or even nonexistent federal role in disaster management. This article by the leadership of the International Association of Emergency ManagersTM-USA Council explores the potential implications of a world without FEMA, focusing on the actions and challenges that SLTT governments…

Jordan Drysdale// HERE IT IS! Finally! For the vsagent from SANS SEC504 (only the finest InfoSec course the world has ever seen!): this is a Q&D deployment guide for the HTTP view state agent demonstrated in the SANS SEC504 labs. The README.md file in the repo has everything you need to get vsagent running for your enjoyment, analysis, and review in a matter of minutes. First, spin up a new Digital Ocean Ubuntu node and capture the IP. We generally throw DNS records at things and if you haven’t integrated your GoDaddy DNS with Digital Ocean’s, now is the time.…

📗 This is the series on creating web applications with generative AI integration. Part 1 focused on explaining the AI stack and why the application layer is the best place in the stack to be. Check it out here. Table of Contents Introduction It’s not often that you hear the Ruby language mentioned when discussing AI. Python, of course, is the king in this world, and for good reason. The community has coalesced around the language. Most model training is done in PyTorch or TensorFlow these days. Scikit-learn and Keras are also very popular. RAG frameworks such as LangChain and LlamaIndex…

Russia-linked APT28 targets western logistics entities and technology firms Pierluigi Paganini May 22, 2025 CISA warns Russia-linked group APT28 is targeting Western logistics and tech firms aiding Ukraine, posing an elevated threat to supply chains Russia-linked cyberespionage group APT28 intensifies its operations against Western logistics and technology companies moving supplies into Ukraine, US CISA warns. The APT28 group (aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. The group was involved also in the string of attacks that targeted 2016 Presidential election. The group operates out of military unity 26165 of the Russian…

A new report from Forescout Technologies highlights a troubling surge in the frequency and impact of data breaches, with organizations of all sizes and across every industry under growing threat. Ransomware dominates as the leading cause, trailed by third-party compromises and phishing attacks. Healthcare organizations were hit especially hard, as nearly half of all breaches affecting more than 5,000 individuals in 2024 targeted the healthcare sector. The report identifies healthcare, financial services, and professional services as the three most heavily affected industries. As of April 30, this year, the healthcare sector has reported 238 confirmed data breaches, compromising the personal…

In this Help Net Security interview, Tim Grieveson, CSO at ThingsRecon, breaks down the first steps security teams should take to regain visibility, the most common blind spots in asset discovery, and why context should drive risk prioritization. What are the first steps a security team should take if they realize their asset inventory is incomplete or outdated? The first step is to openly communicate the issue and alert stakeholders to the potential risks associated with an inaccurate inventory. The mindset that asset inventory is just a “one-time project” is outdated and needs to shift towards maintaining an ongoing living…

Brian Fehrman // In a previous post, titled PowerShell without PowerShell, we showed you how you can bypass Application Whitelisting Software (AWS), PowerShell restrictions/monitoring, and Command Prompt restrictions. In some cases, you might not need all of that; you might just need a way to bypass PowerShell restrictions and/or monitoring. This post presents a simple solution for the aforementioned scenario. This approach is not new but this post attempts to present it in a plain, straight-forward way.  The sections are as follows: Code: The code needed for this solution Compilation: The OS-Dependent commands to compile the code Usage: Instructions on…