Author: HackWatchit

Jordan Drysdale// tl;dr Inventory management and personnel management are critical to making this work. Often, the difference between your company becoming a statistic and catching someone with a foothold in your network is limiting the privilege of users on your systems. If my first check after infecting your systems is whether or not I am a local administrator is successful, you are likely hosed. If you’re just joining this series, you can view previous posts here: Part 1: IntroductionPart 2: InventoryPart 3: Inventory, softwarePart 4: Vulnerability Management CSC #4 – Controlled Use of Admin Privileges Putting together the small network…

In today’s digital-first world, cybersecurity isn’t just an IT issue — it’s a business imperative. And while small businesses may run lean, they carry the same responsibility as large enterprises when it comes to securing data, operations, and reputation.  Adversaries don’t always target by size. They target opportunity wherever it exists. In many SMBs, that opportunity to attack stems from under-resourced teams, outdated tools, and a false sense of security. As threats evolve in speed and complexity, small businesses must evolve too, adopting security strategies that are proactive, intelligent, and built to respond in real time. To understand where SMBs…

A hacker stole data from TeleMessage, the firm that sells modified versions of Signal to the U.S. gov Pierluigi Paganini May 05, 2025 A hacker stole data from TeleMessage, exposing messages from its modified Signal, WhatsApp, and other apps sold to the U.S. government. A hacker stole customer data from TeleMessage, an Israeli firm selling modified versions of popular messaging apps, such as Signal and WhatsApp, to the U.S. government. “The data stolen by the hacker contains the contents of some direct messages and group chats sent using its Signal clone, as well as modified versions of WhatsApp, Telegram, and WeChat.”…

In today’s advanced digital environment, public sector organisations face the dual challenge of maintaining security and enhancing efficiency amid growing cyberthreats. These threats are increasing in complexity, and with employees spread across various locations, protecting sensitive data while facilitating team collaboration is crucial. This situation leaves key applications, systems and data vulnerable to significantly increasing security risks. Additionally, shifts in user interaction with technology bring both new challenges and opportunities. To effectively manage these changes and their impact on cybersecurity, public sector entities must adapt. Prisma® Access Browser (PAB) emerges as a key solution, designed specifically for these challenges. It…

UK-based retailers Marks & Spencer, Co-op, and Harrods have been targeted by cyber attackers in the last few weeks. Whether the attacks have been mounted by the same group is difficult to say for sure: the victimized businesses are sharing little in the way of details and the professed attackers are likely to exaggerate the effect of the attacks and otherwise mislead everyone involved and everyone watching from the outside. What do we know about the attacks It all started – publicly, at least – with a “cyber incident” at British multinational retailer Marks & Spencer. The company confirmed on…

Microsoft has silently fixed an issue that broke Start Menu jump lists for all apps on systems running Windows 10, version 22H2. The Windows 10 jump list feature lets users quickly access recently opened files and tasks using the context menu when right-clicking an app’s icon in the Start menu or the Windows taskbar. As Microsoft explained in an update to the Windows release health dashboard, the issue was caused by a Controlled Feature Rollout (CFR) that started in March 2025, pushing account control experiences that made it easier for users to manage their accounts. Following user reports pointing out…

Amivero, a mission-focused digital services firm and member of the Government Technology & Services Coalition (GTSC), has named Dave Larrimore as its new Senior Vice President of Solutions Engineering. The company shared the news via LinkedIn, marking a significant addition to its executive leadership team. Larrimore brings over a decade of experience leading complex IT modernization efforts across the federal government, with a focus on turning innovation into impact. Before joining Amivero in April 2025, Larrimore served as Chief Technology Officer and Chief AI Officer at the U.S. Department of Homeland Security (DHS), where he helped shape the agency’s adoption…

Darin Roberts// Early in 2018 I wrote a blog about InSpy. InSpy is a great reconnaissance tool that gathers usernames from LinkedIn. My first blog can be found here. A few months ago, a co-worker mentioned to me that InSpy was now requiring an API key. I found out that the updated version did in fact require an API key. The version that I initially used was 2.0.2 and the updated version is 3.0.1. Up until the other day, I have just used the old version of InSpy on my engagements. It has been working and I haven’t had any…

Cyber threat intelligence firm PRODAFT detailed the Nebulous Mantis (a.k.a. Cuba, STORM-0978, Tropical Scorpius, UNC2596), a Russian-speaking cyber espionage group that has actively deployed the RomCom remote access trojan (RAT) and Hancitor loader in targeted campaigns since mid-2019. Operating with geopolitical motives, the group primarily focuses on critical infrastructure, government agencies, political leaders, and NATO-related defense organizations. They use spear-phishing emails with weaponized document links to deliver RomCom for espionage, lateral movement, and data theft.  “Nebulous Mantis has been using the sophisticated RomCom since around mid-2022. This RAT is primarily employed for espionage and ransomware activities,” the researchers wrote in a…