Author: HackWatchit

Does Your Cybersecurity Strategy Justify NHI Costs? Organizations must frequently evaluate their strategies to ascertain if the costs of implementing and maintaining specific security measures are justified. The scenario is no different when it comes to Non-Human Identities (NHIs) and their associated costs. So, is the investment in NHI management justified? The answer, quite simply, is a resounding “yes.” Let’s delve into why. NHIs: A Crucial Pillar of Cybersecurity NHIs represent machine identities that include encrypted passwords, tokens, keys, or other unique identifiers that serve as “passports”. The associated permissions granted by a destination server act as the “visa” that…

Do your PowerShell scripts keep getting caught? Tired of dealing with EDRs & Windows Defender every time you need to pop a box?  In this one-hour podcast, originally recorded as a live webcast, we introduce a somewhat new Red Team approach that we call BYOI (Bring Your Own Interpreter). Download slides: https://www.activecountermeasures.com/presentations/ Turns out, by harnessing the powah of C# and the .NET framework you can embed entire interpreters inside of a C# binary. This allows you to dynamically access all of the .NET API from a scripting language of your choosing without going through Powershell in any way!  We…

In December 2024, I wrote an article sharing my experience using VSCode (GitHub Copilot) and Cursor (Claude 3.5 Sonnet) from the perspective of a Data Scientist. I concluded the article by stating: After using Cursor for the past two weeks, I have decided to use it for all of my future projects. Since writing this article, not only have there been significant developments to VSCode and Cursor, but a new wave of AI-powered IDEs (e.g. Windsurf) have emerged. Upon evaluating and testing these alternative IDEs, I have decided to revert to VSCode as my primary IDE of choice. In this…

Microsoft has announced that it will discontinue the password storage and autofill feature in the Authenticator app starting in July and will complete the deprecation in August 2025. The decision is to streamline autofill support and consolidate credentials management under a single platform, Microsoft Edge. The move requires action from impacted users as they are given until August 1, 2025, to export their information from Authenticator, or risk losing it. Microsoft Authenticator is a free mobile app (iOS and Android) that provides secure sign-in for mobile accounts using multi-factor authentication (MFA) methods like time-based one-time passwords (TOTPs), push notifications, or biometrics-based confirmations. The…

The future of the State Department Bureau of Cyberspace and Digital Policy is in flux as the Trump administration prepares to demote the bureau and split its functions under an agency-wide reorganization plan. But wherever it ends up on the State Department organizational chart, foreign affairs experts say the bureau should remain an integrated unit that oversees international cybersecurity and broader digital economy issues. The CDP bureau currently reports directly to the deputy secretary of state. But under the reorganization plan unveiled by Secretary of State Marco Rubio last week, the bureau would be split up. The ambassador-at-large for cyberspace…

DragonForce group claims the theft of data after Co-op cyberattack Pierluigi Paganini May 03, 2025 Hackers claim Co-op cyberattack is worse than admitted, with major customer and employee data stolen, and provide proof to the BBC. The attackers behind the recent Co-op cyberattack, who go online with the name DragonForce, told the BBC that they had stolen data from the British retail and provided proof of the data breach. Hackers shared screenshots with BBC of their first extortion message to Co-op’s cyber chief via Microsoft Teams on 25 April. They also called the head of security at the company around…

watchTowr reveals active exploitation of SonicWall SMA 100 vulnerabilities (CVE-2024-38475 & CVE-2023-44221) potentially leading to full system takeover and session hijacking. Learn about affected models, available patches, and CISA’s urgent warning. Cybersecurity researchers at watchTowr have spotted malicious threat actors actively leveraging known security vulnerabilities in SonicWall’s widely used SMA 100 (Secure Mobile Access) appliances. This discovery, documented in their latest blog post shared with Hackread.com, reveals how attackers are combining two specific vulnerabilities to potentially gain complete administrative control over these devices. Evidence suggests these techniques are already being employed in real-world attacks, making immediate awareness and action critical…

In this BHIS webcast, we cover some new techniques and tactics on how to track attackers via various honey tokens.  We cover how to track with Word Web Bugs in ADHD and cover the awesome toolkit from Thinkst.   We also cover some of the legal ramifications involved in doing this. Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_TrackingAttackersAttribution.pdf I am covering this for a couple of reasons. First, there are a lot of companies who are selling cyber deception in the form of honeypots, which is cool – but not near enough for attribution. Also, it is time to start gearing…

Here’s a look at the most interesting products from the past month, featuring releases from: 1touch.io, Abnormal AI, AppViewX, Arctic Wolf Networks, Bitdefender, BitSight, Bugcrowd, Cato Networks, CyberQP, Cyware, Entrust, Exabeam, Flashpoint, Forescout, Index Engines, Jit, LastPass, PlexTrac, PowerDMARC, RunSafe Security, Saviynt, Seal Security, Seemplicity, Skyhawk Security, Stellar Cyber, Swimlane, Varonis, and Veracode. Email authentication simplified: How PowerDMARC makes DMARC effortless With PowerDMARC, users can generate and publish DMARC, SPF, and DKIM records with a few clicks—no manual syntax editing or DNS guesswork needed. The platform validates entries in real time and alerts you if anything breaks authentication, ensuring seamless…