Author: HackWatchit

In brief Aave’s token surged 20% as Congress advanced the GENIUS Act, a bill that could bring regulatory clarity to stablecoins. The protocol, which supports lending and borrowing of major stablecoins, recently surpassed $25B in Total Value Locked. AAVE is up over 90% in 30 days, outperforming major altcoins and the broader crypto market. The native token of DeFi lending protocol Aave has surged by double-digit gains on the day, rallying alongside a key procedural vote in Congress on the long-anticipated GENIUS Act.If enacted, the bill would provide long-awaited regulatory clarity for stablecoins—a sector in which Aave is deeply embedded.Specifically,…

Rick Wisser// Here at BHIS we are always on the lookout for new toys. Especially if we can use them during a pentest. As a pentester, we all have a complimentary tool set in our jump bags that we have grown accustomed to using. Tools such as the Rubber Ducky, Konboot, Lan Turtle, proxmark3, crowbar (try getting that past TSA), etc are utilized in certain capacities depending on the situation we find ourselves in during a physical assessment. Like a group of little kids when we find something exciting we share it with everyone and of course everyone wants one…

It started like any other Monday morning. Coffee cups steamed beside keyboards, servers hummed gently in climate-controlled rooms, and email inboxes pinged with weekend catch-up. But within minutes, that ordinary day at one of the world’s largest logistics firms spiraled into chaos. Files wouldn’t open. Systems froze. And then came the chilling message, glowing on every monitor: “Your files have been encrypted. Pay $10 million in Bitcoin, or lose everything.” This wasn’t fiction. It was NotPetya – one of the most devastating ransomware attacks in history. What started as a seemingly contained cyber incident in Ukraine in 2017 quickly morphed…

Latin America has quickly become a hotspot for cyber activity. The region’s rapid digitalization, expanding cloud adoption, and evolving geopolitical friction have drawn the attention of both financially motivated eCrime actors and strategic nation-state adversaries. The CrowdStrike 2025 Latin America Threat Landscape Report provides key insights into cyber activity across Central and South America, Mexico, and the Caribbean. In its pages, CrowdStrike Counter Adversary Operations team details the eCrime activity, targeted intrusions, hacktivist disruptions, and cyber espionage targeting organizations in the region. For organizations operating in or connected to Latin America, understanding this activity is critical to defending against it.…

A suspected initial access broker has been leveraging trojanized versions of the open-source KeePass password manager to set the stage for ransomware attacks, WithSecure researchers have discovered. KeeLoader: Passoword manager that acts as data stealer and malware loader In February 2025, WithSecure’s inicident responders were hired by an European IT service provider to help with response and remediation after a ransomware gang encrypted their VMware ESXi servers’ datastores. While the attack itself was relatively typical, the thing that stood out was the use of an undocumented malware loader that was built into the legitimate KeePass password manager, and this trojanized…

Microsoft has officially open-sourced the Windows Subsystem for Linux (WSL), closing the very first issue ever filed on the Microsoft/WSL GitHub repository: “Will this be open source?” WSL allows developers to run unmodified Linux command-line tools, utilities, and applications directly on Windows, without the overhead of a traditional virtual machine or dual-boot setup. WSL architecture overview (Source: Microsoft) The first version of WSL was introduced in 2016 and implemented as a compatibility layer within the Windows kernel. To improve system call compatibility and performance, WSL 2 was released in 2019, leveraging a real Linux kernel running in a lightweight virtual…

High-pressure incidents can be defining moments for organizations, demanding immediate, coordinated, and often high-stakes responses. In the realm of cybersecurity, where threats evolve rapidly and stakes include sensitive data, reputational damage, and financial loss, the pressure to act quickly is intense. While technical tools and expertise often take center stage in incident response, an equally critical and sometimes underestimated component is effective communication. As leadership expert Simon Sinek famously said, “Leadership is not about being in charge. It is about taking care of those in your charge.” In the heat of a cyber crisis, that care manifests through structured, empathetic,…

Threat actors have been distributing trojanized versions of the KeePass password manager for at least eight months to install Cobalt Strike beacons, steal credentials, and ultimately, deploy ransomware on the breached network. WithSecure’s Threat Intelligence team discovered the campaign after they were brought in to investigate a ransomware attack. The researchers found that the attack started with a malicious KeePass installer promoted through Bing advertisements that promoted fake software sites. As KeePass is open source, the threat actors altered the source code to build a trojanized version, dubbed KeeLoader, that contains all the normal password management functionality. However, it includes…

Sarcoma Ransomware Unveiled: Anatomy of a Double Extortion Gang Pierluigi Paganini May 20, 2025 Cybersecurity Observatory of the Unipegaso’s malware lab published a detailed analysis of the Sarcoma ransomware. It is with great pleasure and honor that I present the first report produced by the Malware Analysis Lab, led by Luigi Martire. The lab was established within the Cybersecurity Observatory of the Unipegaso University, which I have the privilege of directing.Our mission is to analyze the main malware threats affecting systems worldwide, dissect major malicious codes, and share our findings with the international community.This is an open project, so if…