Author: HackWatchit

As we usher in a new year, it’s crucial to focus on key areas in cybersecurity that demand our attention. While there’s undoubtedly a long list of issues that all companies are dealing with, these are three topics – mitigating risks from vendors, navigating the complexities of AI, and combating phishing – that should be at the top of the list while planning for a successful 2025. Mitigating risks from vendors. Relationships with vendors are constantly evolving as are the threats. Before the advent of cloud computing and SaaS there was a layer of separation between the vendor and customer. The…

Darktrace, a vendor of AI for cybersecurity solutions, announced this week enhancements to its Network Detection and Response (NDR) solution to address the complex demands of modern enterprise networks. These latest innovations and integrations continue to extend beyond traditional NDR solutions to offer deeper visibility, more precise autonomous response, new proactive risk management capabilities, and integrations to augment novel threat detection for Secure Access Service Edge (SASE) and Zero Trust Network Access (ZTNA) technologies. The news comes on the heels of enhancements to Darktrace Cyber AI Analyst, which pushes the boundaries of NDR by conducting AI-led investigations of all relevant…

SessionShark phishing kit bypasses Office 365 MFA by stealing session tokens. Experts warn of real-time attacks via fake login pages and Telegram alerts. SlashNext security experts have discovered a new tool called “SessionShark” used by cyber criminals to steal login information for Microsoft Office 365. This tool can bypass multi-factor authentication (MFA), a security feature that requires a phone code in addition to a password to add another layer of security. SlashNext’s research, shared exclusively with Hackread.com, revealed that online advertisements for SessionShark were found on secret cybercrime networks, indicating the tool was designed to steal session tokens, which are…

Storm-1977 targets education sector with password spraying, Microsoft warns Pierluigi Paganini April 27, 2025 Microsoft warns that threat actor Storm-1977 is behind password spraying attacks against cloud tenants in the education sector. Over the past year, Microsoft Threat Intelligence researchers observed a threat actor, tracked as Storm-1977, using AzureChecker.exe to launch password spray attacks against cloud tenants in the education sector. AzureChecker.exe connected to sac-auth[.]nodefunction[.]vip to download AES-encrypted data, which, once decrypted, revealed password spray targets. It also accepted an accounts.txt file with username and password pairs, using both datasets to validate credentials against target tenants. Microsoft observed a successful account…

Securing federal cloud environments: CISA SCuBA reminds cloud service providers of the basics These steps are essential for maintaining strong cybersecurity hygiene and preventing many of the attacks organizations face today. Shunta Sharod Sanders April 23, 2025 6:45 pm 3 min read Time and time again, we see malicious threat actors targeting cloud environments — largely due to the improper configuration of security controls in these environments. We repeatedly see this issue throughout the federal government due to agencies migrating to cloud computing without fully understanding the complexity of services or the controls offered in cloud computing. Most recently, Nemesis…

The evolving ransomware landscape and the growing threat of data exfiltration.  Ransomware is more than just a cyberthreat—in recent years it has evolved into a major societal crisis. A single successful attack can disrupt essential services, destabilize local economies, and cause cascading effects across entire communities. A notable example was the 2021 attack on Colonial Pipeline, where a single ransomware incident triggered panic buying, widespread fuel shortages, and a spike in gas prices across the East Coast of the United States. This incident made ransomware mainstream news and, what was once viewed as an IT issue, suddenly became a national…

​Baltimore City Public Schools notified tens of thousands of employees and students of a data breach following an incident in February when unknown attackers hacked into its network. Established in 1829, the public school district provides primary and secondary education to 76,841 enrolled students through 164 schools and programs. “On February 13, 2025, Baltimore City Public Schools experienced a cybersecurity incident affecting certain IT systems within our network. We promptly notified law enforcement, conducted an initial investigation, and took steps to confirm the security of our systems,” City Schools said in a Tuesday notification. “Following a thorough investigation with the…

The release of GPT-4o’s image generation feature has sparked a provocative question: What happens to NFTs when AI can replicate any artistic style on demand? Upload an NFT image, type a prompt like “Studio Ghibli-inspired” or “cyberpunk transformation,” and the tool instantly reimagines it. Want to turn your crypto wallet’s avatar into an Azuki-style character? Done. But as AI democratizes access to once-exclusive visual aesthetics, the NFT ecosystem faces an existential crossroads. Will style itself become the new battleground for ownership—and value?Style as Ownership For years, NFTs derived their value from provable scarcity and community-driven identity. Projects like CryptoPunks and Bored Ape…

Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_HowToPlayBackdoorsBreaches.pdf More info: https://www.blackhillsinfosec.com/projects/backdoorsandbreaches/ 2:09 Introduction to the types of cards in the deck, pricing, why we created B&B 10:25 Basic setup for playing the game and how to play the game 18:03 Breaking down cards and how they work 35:54 Demo Game 1 44:39 Demo Game 2 54:50 Questions and comments This webcast was originally recorded live on October 16th, 2019 with John Strand. In this webcast, we’ll show you: how the game works, how to play, how to get your team involved, how to translate to management what you learn by…