Author: HackWatchit

Kelsey Bellew//* It’s an occupational hazard to see vulnerabilities everywhere. When I see a router sitting in plain sight I think, “The default creds are probably printed on the back; I wonder if those were ever changed?” When I see an unattended locked door propped open by a shoe or a box, it’s “Why would they just leave it like that? Should I go close it? Do they not have a key?” When I see a friend or family member who doesn’t even have a pattern lock set up on their phone, I start preaching, horrified, about how they’re doing…

The Trump administration plans to put millions of defaulted federal student loan borrowers into collections starting Monday (May 5). This action threatens the confiscation of tax refunds, federal benefits and wages from affected individuals. The move marks a significant policy shift, reversing a program taken by the Biden administration that attempted broad student debt forgiveness and extended a no-consequences period for nonpayment through the 2024 election. Approximately 5 million borrowers are currently in default, many of whom have not made payments since the pandemic-era pause, intended to alleviate borrowers’ financial strain amid the economic downturn, ended in 2023, according to…

Experts shared up-to-date C2 domains and other artifacts related to recent MintsLoader attacks Pierluigi Paganini May 05, 2025 MintsLoader is a malware loader delivering the GhostWeaver RAT via a multi-stage chain using obfuscated JavaScript and PowerShell. Recorded Future researchers observed MintsLoader delivering payloads like GhostWeaver via obfuscated scripts, evading detection with sandbox/VM checks, and uses DGA and HTTP C2. MintsLoader is a malware loader that was first spotted in 2024, the loader has been observed delivering various follow-on payloads like StealC and a modified version of the Berkeley Open Infrastructure for Network Computing (BOINC) client. it implements a multi-stage infection…

In a previous HackerNoon article, “You Can’t Build the Future While Trapped in the Web2 Frame of Thinking”, we explored how clinging to outdated methodologies can prevent us from truly innovating in the Web3 space. Today, I want to expand on this concept and address another critical trap many developers fall into i.e. the endless pursuit of certifications and hackathon trophies instead of building meaningful products and systems.I recently stumbled upon one of my old time favorites, The Last Dragon – a 1985 American musical martial arts film. This inspired me to write this piece. The parallels between mastering martial…

The invention of ViT (Vision Transformer) causes us to think that CNNs are obsolete.  But is this really true? It is widely believed that the impressive performance of ViT comes primarily from its transformer-based architecture. However, researchers from Meta argued that it’s not entirely true. If we take a closer look at the architectural design, ViT introduced radical changes not only to the structure of the network but also to the model configurations. Meta’s researchers thought that perhaps it is not the structure that makes ViT superior, but its configuration. In order to prove this, they tried to apply the ViT…

Fortinet’s FortiGuard Labs Incident Response (FGIR) team uncovered a prolonged cyber intrusion targeting critical national infrastructure in the Middle East, attributed to a state-sponsored threat actor. The campaign, active from at least May 2023 to February 2025, with indications dating back to May 2021, involved extensive espionage and suspected network prepositioning to ensure long-term strategic access. Attackers initially breached the network using stolen VPN credentials, then maintained persistence through multiple web shells and backdoors, including Havoc, HanifNet, HXLibrary, and NeoExpressRAT. They circumvented network segmentation using open-source proxy tools such as plink, Ngrok, Glider Proxy, and ReverseSocks5. The researchers detailed that…

Carrie Roberts //* SSHazam is a method of running any C2 tool of your choice inside a standard SSH tunnel to avoid network detections. The examples here involve running PowerShell Empire, which connects to a localhost port on the victim. The local port is forwarded to the remote Empire server through an SSH connection so that the only network traffic seen is SSH. The victim system in this example is OS X but the same technique could be done on Windows using Plink.exe, part of the Putty toolset. The image above shows the victim system has an SSH Tunnel configured…

Organizations are rapidly adopting cloud platforms to accelerate development, scale operations, and optimize efficiency. VMware’s robust cloud solutions, including VMware® Tanzu Platform and VMware vCenter, are among the critical tools that empower teams to build, deploy, and manage workloads with ease. However, this evolution brings new security challenges. Virtual machines, container images, and other cloud assets can become attack vectors if not properly protected. Security teams must ensure every workload, whether in pre-runtime or runtime, is continuously monitored and secured against evolving threats. To help customers meet these challenges, CrowdStrike Falcon® Cloud Security has expanded support to VMware software to…

Why Opt for Budget-Friendly NHIs? Ever wondered how budget-friendly Non-Human Identities (NHIs) can redefine your organization’s cybersecurity? Through the strategic management of NHIs and their secrets, businesses can establish robust security controls, decrease the risk of breaches, and promote company-wide compliance – all while staying within budget. Cybersecurity Redefined: Harnessing the Power of NHIs NHIs are machine identities used in cybersecurity. These are created by combining a “Secret” – an encrypted password, token, or key (resembling a passport), and the permissions granted to that Secret by a destination server (acting as a visa). Ensuring the security of NHIs and their…