Author: HackWatchit
In the wake of last week’s revelation of a breach at Salesloft by a group tracked by Google as UNC6395, several companies – including Zscaler, Palo Alto Networks, PagerDuty, Tanium, and SpyCloud – have confirmed their Salesforce instances were accessed. The companies noted that attackers had only limited access to Salesforce databases, not to other systems or resources. They warned, however, that the stolen customer data could be used for convincing phishing and social engineering attacks. The Salesloft breach Salesloft is the company behind a popular sales engagement platform of the same name. The company’s Drift application – an AI…
Podcast: Play in new window | Download (Duration: 8:25 — 7.8MB)Subscribe: TuneIn | By Adam Turteltaub As with so many other areas, communication, or a lack of it, can be a big problem when it comes to eDiscovery. Legal doesn’t always adequately communicate what it needs. The business unit doesn’t share information about all the technologies its teams are using to communicate, and compliance may be giving the wrong message as a result. The cure, as Joey Seeber, CEO of Level Legal lays out in this podcast, is making sure that everyone is aware of the issues, the technology and…
Jack Hyland has worked in information security ever since graduating college and has dedicated his free time to deeply learning new techniques and technologies. He now spends his time creating and contributing to open-source projects along with performing security assessments of corporations networks and infrastructure. This blog is a resource associated with the following webcasts and a Wild West Hackin’ Fest 2025 talk. The site was previously hosted at https://m.ail.fail but was transferred to the official BHIS blog. MailFail is a Firefox browser extension that identifies and provides commands to exploit a large number of email-related misconfigurations for the current…
Hackers exploited the Salesloft Drift app to steal OAuth tokens and access Salesforce data, exposing customer details at major tech firms. In a large-scale cyberattack, a hacking group has stolen sensitive customer information from numerous companies, including prominent cybersecurity and technology firms like Palo Alto Networks, Zscaler and PagerDuty. The attack did not directly target these companies’ main systems but instead exploited a vulnerability in a widely used third-party sales and marketing application called Salesloft Drift. The Supply Chain Breach The cyberattack, carried out by a group tracked as UNC6395, was a classic “supply chain” breach. It targeted Salesloft Drift,…
Cloudflare on Monday said it blocked the largest distributed denial-of-service (DDoS) attack ever recorded, at 11.5 Tbps (Terabits per second). In a short message on X, Cloudflare only shared that the attack was a UDP flood that mainly originated from Google Cloud infrastructure and that it lasted approximately 35 seconds. “Cloudflare’s defenses have been working overtime. Over the past few weeks, we’ve autonomously blocked hundreds of hyper-volumetric DDoS attacks, with the largest reaching peaks of 5.1 Bpps and 11.5 Tbps. The 11.5 Tbps attack was a UDP flood that mainly came from Google Cloud,” the company said. A UDP flood…
Salt Typhoon Didn’t Hack Their Way In – They Logged In The Salt Typhoon campaign, a sophisticated operation attributed to a state-sponsored actors, revealed a chilling reality: attackers don’t always need exploits to breach critical infrastructure. Instead, they used stolen credentials and protocol weaknesses to blend in seamlessly. Here’s how their playbook unfolded, based on reports from Cisco Talos and other sources: Target Administrators: Attackers focused on network operators with high privileges, managing routers, switches, and firewalls. Harvest TACACS+ Traffic: Traditional TACACS+ encrypts only the password field, leaving usernames, authorization messages, accounting exchanges, and commands in plaintext, vulnerable to interception.…
Internet infrastructure company Cloudflare said it recently blocked the largest recorded volumetric distributed denial-of-service (DDoS) attack, which peaked at 11.5 terabits per second (Tbps). In volumetric DDoS attacks, attackers overwhelm the target with massive amounts of data, consuming the bandwidth or exhausting system resources, leaving legitimate users with no access to the targeted servers and services. “Cloudflare’s defenses have been working overtime. Over the past few weeks, we’ve autonomously blocked hundreds of hyper-volumetric DDoS attacks, with the largest reaching peaks of 5.1 Bpps and 11.5 Tbps,” the company said in a Tuesday tweet. “The 11.5 Tbps attack was a UDP…
A few days ago, my friend Javvad Malik—a sharp voice in our industry and someone I trust—shared something that made me stop and think. Javvad, KnowBe4’s security awareness advocate, summed up the state of things beautifully: “Cyber risk is not just about advanced technology; it is about human bandwidth and the cognitive load of today’s.. The post Distraction is the New Zero-Day: The Human Risk We Keep Ignoring appeared first on Security Boulevard.
In the Author Spotlight series, TDS Editors chat with members of our community about their career path in data science, their writing, and their sources of inspiration. Today, we’re thrilled to share our conversation with Egor Howell. Egor is a data scientist and machine learning engineer specialising in time series forecasting and combinatorial optimisation. He runs a content and coaching business helping people break into data science and machine learning, as well as teaching technical topics Let’s start at the beginning: What sparked your initial interest in data science, especially since you didn’t follow the traditional CS degree or bootcamp…