Author: HackWatchit

I’m a huge fan of interactive visualizations. As a computer vision engineer, I deal almost daily with image processing related tasks and more often than not I am iterating on a problem where I need visual feedback to make decisions. Let’s think of a very simple image processing pipeline with a single step that has some parameters to transform an image: How do you know which parameters to adjust? Does the pipeline even work as expected? Without visualizing your output, you might miss out on some key insights and make sub optimal choices. Sometimes simply showing the output image and/or…

A China-aligned APT threat actor named “TheWizards” abuses an IPv6 networking feature to launch adversary-in-the-middle (AitM) attacks that hijack software updates to install Windows malware. According to ESET, the group has been active since at least 2022, targeting entities in the Philippines, Cambodia, the United Arab Emirates, China, and Hong Kong. Victims include individuals, gambling companies, and other organizations. The attacks utilize a custom tool dubbed “Spellbinder” by ESET that abuses the IPv6 Stateless Address Autoconfiguration (SLAAC) feature to conduct SLACC attacks. SLAAC is a feature of the IPv6 networking protocol that allows devices to automatically configure their own IP addresses and default…

Russia-linked group Nebulous Mantis targets NATO-related defense organizations Pierluigi Paganini April 30, 2025 PRODAFT researchers warn of Russia-linked APT group Nebulous Mantis targeting NATO-related defense organizations Nebulous Mantis, a Russian-speaking cyber espionage group (aka Cuba, STORM-0978, Tropical Scorpius, UNC2596), used RomCom RAT and Hancitor since 2019 to target critical infrastructure, governments, and NATO-linked entities. Since mid-2022, they’ve deployed RomCom via spear-phishing for espionage, lateral movement, and data theft. The RAT supports advanced evasion techniques, including living-off-the-land (LOTL) tactics and encrypted command and control (C2) communications. The malicious code continuously evolves its C2 infrastructure, relying on bulletproof hosting to maintain persistence…

Vulnerabilities in Apple’s AirPlay Protocol, AirPlay Software Development Kits (SDKs), and the CarPlay Communication Plug-in could allow attackers to compromise AirPlay-enabled devices developed and sold by Apple and by other companies. “Because AirPlay is a fundamental piece of software for Apple devices (Mac, iPhone, iPad, AppleTV, etc.) as well as third-party devices that leverage the AirPlay SDK, this class of vulnerabilities could have far-reaching impacts,” Oligo Security researchers noted. “AirBorne” vulnerabilities These so-called “AirBorne” flaws could be used in a variety of attack scenarios, including: Employee devices that have been compromised while on a public wireless network could be used…

If you thought only your boss was peeking at your work screen, think again.As Cybernews reports, employee-monitoring tool Work Composer has committed a jaw-dropping blunder, leaving a treasure trove of millions of workplace screenshots openly accessible on the internet with no encryption in place, and no password required.Over 21 million images of capture employees’ screens – along with usernames, IP addresses, and device details, were left sitting on an unsecured Amazon S3 storage bucket.A tool which was intended to, amongst other things, monitor unusual or suspicious behaviour by over 200,000 workers around the globe has itself leaked secret and sensitive…

RSAC 2025 Conference is taking place at the Moscone Center in San Francisco. Help Net Security is on-site, and this gallery takes you inside the event. The featured vendors are: PowerDMARC, Skyhawk Security, ThreatLocker, Stellar Cyber, Center for Internet Security, PlexTrac, ISC2, Bitdefender, SentinelOne, and SailPoint.

Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_AttackTactics7LogsYouAreLookingFor.pdf So we went through an attack in the BHIS Webcast, “Attack Tactics 5! Zero to Hero Attack.” Then we went through the defenses in a follow-up webcast, “Attack Tactics 6! Return of the Blue Team,” and now we need to have a talk about logs. Here is the deal, most of the default logging settings for IIS, Exchange, Active Directory and the workstations would have missed the entire attack. So, let’s fix that. In this webcast, we will be walking through some configuration changes required in order to detect attacks. We…

US and Greek arrests expose 764 network’s global child abuse ring. Leaders face life for orchestrating violent exploitation through encrypted apps. In what can be called one of the most extensive and disturbing cybercrime crackdowns in recent years, the United States and international authorities have arrested two leading figures behind the violent extremist network known as “764,” a group accused of creating a sadistic online operation targeting minors across multiple countries. Leonidas Varagiannis, 21, an American living in Thessaloniki, Greece, and Prasan Nepal, 20, of North Carolina, were charged with leading an online child exploitation ring that authorities say lasted…

The European Network for Cyber Security (ENCS) submitted earlier this month feedback to the European Commission on the Cyber Resilience Act (CRA) technical description of the categories of important and critical products with digital elements. Various activities, including webinars and online consultations, were hosted to get feedback and comments from members and experts. Anjos Nijk, managing director of ENCS, wrote in a statement to Industrial Cyber, that the Cyber Resilience Act will be instrumental to strengthening cybersecurity across Europe, but it’s essential that its definitions are precise and aligned with operational realities in critical sectors like energy. “Inaccurate definitions –…