Author: HackWatchit

Rick Wisser // Note: This blog will also be a lab for any of the upcoming Wild West Hackin’ Fest Conferences. During a recent engagement, I came across an issue. The issue I encountered was that the SPI chip I was trying to dump the firmware off of was a 1.8v chip. This would not have been a problem but both the shikra and bus pirate are rated for 3.3v chips. I considered creating a voltage divider to step the voltage down but after a little Googling, I came across the CH341a with the 1.8v adapter. I decided to order…

Skyhawk Security is adding new protection for custom-built cloud applications. The company announced the update to its AI-powered Autonomous Purple Team for RSAC 2025 Conference, which starts April 28 in San Francisco. The AI-based purple team identifies security weaknesses and then prioritizes them based on the business value of the asset Proactive cloud defense This expansion helps companies spot security gaps in their cloud applications before attackers do. Skyhawk Security now scans both applications and infrastructure together, simulating how real attacks unfold across layers. It also watches continuously for threats — all without installing agents on systems. Skyhawk Security’s platform…

Hackers in the Elusive Comet campaign exploit Zoom’s remote-control feature to steal cryptocurrency, and over $100K lost in social engineering scam. A new cybercrime campaign called “Elusive Comet” is targeting professionals in the cryptocurrency space. But, instead of going after blockchain tech directly, the attackers are using Zoom’s remote-control features to gain access to targeted devices. Cybersecurity firm Security Alliance (SEAL) broke down the details in a report published in March 2025. Security Alliance (SEAL) in March 2025. The Elusive Comet campaign is a social engineering scam where cybercriminals impersonate legitimate figures to lure victims into Zoom meetings. They often…

Mandiant has released the M-Trends 2025 report, which outlines global cyber attack trends based on their own incident response engagements from 2024. Key trends and insights In 2024, Mandiant handled more incidents in the financial sector than in any other industry: 17.4%. Other popular targets? Companies in business and professional services (11.1%), high tech (10.6%), government (9.5%), and healthcare (9.3%). Exploitation of a vulnerability is still the most common initial infection vector (33%), followed by stolen credentials (16%), email phishing (14%) and web compromise (9%). (In 34% of 2024 intrusions they handled, Mandiant could not determine how the attackers gained…

Blue Shield of California disclosed it suffered a data breach after exposing protected health information of 4.7 million members to Google’s analytics and advertisement platforms. The nonprofit health plan, which serves nearly 6 million members across California, published a data breach notification on its website stating that member data was exposed between April 2021 and January 2024. Today, the United States Department of Health and Human Services breach portal was updated to state that the leak exposed 4.7 million members’ protected health data. Source: ocrportal.hhs.gov According to the notice, the exposure was caused by a misconfiguration of Google Analytics on certain Blue Shield…

The relationship between an insurance provider and the insured is often described as adversarial: one party reluctantly pays a premium, while the other is reluctant to pay out if possible. But cyber insurance doesn’t have to be this way. The increasingly volatile threat landscape means cyber insurance is fast becoming a critical part of risk management. Yet there are often strict requirements when it comes to cyber insurance, including specifications around the integrity of backups—which is unsurprising, given that 57% of successful ransomware attacks also compromise backups. To best position a business for solid coverage at a competitive rate, they…

Marcello Salvati // This fairly lengthy blog post aims at providing Red Team Operators ideas on how to incorporate BYOI tradecraft into their own custom tooling and get those creative malware development juices flowing. This blog post can also serve as a “light” introduction to .NET and how to write basic C2, so there’s hopefully going to be something here for everybody regardless of your skill level. We’re going to start from scratch and develop a bare-bones PowerShell implant which will utilize the BYOI concept to bypass Defender & AMSI on the latest build of Windows 10. Along the way,…

Background Ethereum co-founder Vitalik Buterin recently proposed replacing the current Ethereum Virtual Machine (EVM) with the RISC-V instruction set architecture. This proposal has sparked widespread discussion within the Ethereum community and highlighted the potential of RISC-V in the blockchain space. In parallel, Lumoz RaaS (Rollup as a Service) has announced support for a RISC-V–based zkEVM solution, aiming to deliver higher performance and scalability for Layer2. The EVM has long been the core of smart contract functionality, supporting a diverse ecosystem of decentralized applications. However, as blockchain technology evolves, the architectural limitations of the EVM are becoming increasingly evident. As an…

AI security is a crtical issue in today’s landscape. With developers, teams, employees and lines of business racing ahead to compete, security teams consistently fall short in an ecosystem where new risks are rising up every day. The result is that we are seeing an unprecedented amount of AI breaches in 2025. According to Capgemini, 97% of organizations suffered incidents related to generative AI initiatives in the past year.  It is unclear whether these incidents were all breaches, or whether some were merely vulnerabilities, however, around half of these organizations reported the loss impact would be  estimated at $50M+ per…