Author: HackWatchit

Oracle has released version 8 of its Unbreakable Enterprise Kernel (UEK), a custom Linux kernel built for Oracle Linux. UEK 8 includes updates to memory management, better file system support, faster networking, and improvements for specific hardware platforms. It also pulls in changes from the wider Linux community. UEK 8 is designed to handle heavy workloads. It builds on the combination of Oracle Linux and UEK to support large enterprise systems. That includes setups using Oracle Database, Oracle Exadata, and Oracle Cloud Infrastructure (OCI), across distributed environments. “This is our eighth release of UEK, and I think it’s the best…

Russia-linked APT29 targets European diplomatic entities with GRAPELOADER Pierluigi Paganini April 21, 2025 Russia-linked group APT29 targeted diplomatic entities across Europe with a new malware loader codenamed GRAPELOADER. Check Point Research team reported that Russia-linked cyberespionage group APT29 (aka SVR group, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, and The Dukes) is behind a sophisticated phishing campaign targeting European diplomatic entities, using a new WINELOADER variant and a previously unknown malware called GRAPELOADER. “While the improved WINELOADER variant is still a modular backdoor used in later stages, GRAPELOADER is a newly observed initial-stage tool used for fingerprinting, persistence, and payload delivery. Despite differing roles, both share similarities…

Kristina TanasichukFrom terrorism to the homeland security business enterprise, for over 20 years Kristina Tanasichuk has devoted her career to educating and informing the homeland community to build avenues for collaboration, information sharing, and resilience. She has worked in homeland security since 2002 and has founded and grown some of the most renowned organizations in the field. Prior to homeland she worked on critical infrastructure for Congress and for municipal governments in the energy sector and public works. She has 25 years of lobbying and advocacy experience on Capitol Hill on behalf of non- profit associations, government clients, and coalitions.…

David Fletcher // This blog post discusses the relevance and techniques involved in logon script abuse. While the Backdoors & Breaches card is featured for this topic, the post will provide context for understanding how an attacker can abuse this functionality and details that are useful in monitoring for such abuses. Operating systems typically have features that allow an administrator or user to automatically execute commands during session initiation to ease the burden of administration in the context of a given environment. An attacker can take advantage of those features to execute commands of their own in order to gain…

Hawk Eye is an open-source tool that helps find sensitive data before it leaks. It runs from the command line and checks many types of storage for PII and secrets: passwords, API keys, and personal information. “Unlike most open-source tools that only scan cloud buckets for PII, this solution is designed for deep integration across your entire ecosystem. It supports 350+ file types (including videos, images, and documents), uses advanced OCR, and ensures complete data privacy by running entirely on-prem. No data ever leaves your environment,” Rohit Kumar, the developer of Hawk Eye, told Help Net Security. Features Hawk Eye…

A remote code execution vulnerability affecting SonicWall Secure Mobile Access (SMA) appliances has been under active exploitation since at least January 2025, according to cybersecurity company Arctic Wolf. This security flaw (CVE-2021-20035) impacts SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v devices and was patched almost four years ago, in September 2021, when SonicWall said it could only be exploited to take down vulnerable appliances in denial-of-service (DoS) attacks. However, the company updated the four-year-old security advisory on Monday to flag the security bug as exploited in attacks, expand the impact to include remote code execution, and…

High-profile cyberattacks involving ransomware, malware, zero-day exploits, and nation-state intrusions dominate headlines. These attacks are bold, disruptive, and external, commanding attention from security teams to detect and stop these threats. Amid the noise, a quieter danger is gaining momentum from within: insider threats. Often overlooked and notoriously difficult to detect, insider threats are becoming increasingly common and dangerous as organizations undergo layoffs, restructuring, and resource constraints. These shifts create a perfect storm for insider threats that businesses are unprepared to weather. Why Insider Threats Go Undetected   Security strategies typically focus on perimeter defenses, based on the assumption that the most…

Hello and welcome, and in this video, we’re going to be talking a little bit about Portspoof, a fantastic utility that takes your unused TCP/IP ports and turns them into something different whenever an attacker actually goes about trying to scan them. This video is part of the Active Defense and Cyber Deception class that we run at Wild West Hackin’ Fest in San Diego and in Deadwood and also I run in Black Hat. Now as always, with all of these videos, we’re going to be using the Active Defense Harbinger Distribution. Once again, if you want this distribution,…

In today’s representative democracies, citizens typically have a say only once every few years when electing their leaders. Beyond that, the average person has little to no influence over how their country is run. In an ideal system, people would be able to participate in decision-making in a much more direct way. However, implementing such a system is extremely challenging. Holding frequent referendums is both inconvenient and expensive, especially since the most reliable method still involves paper-based voting.Today, however, thanks to technologies like blockchain and zero-knowledge proofs, it’s the first time we can realistically imagine replacing paper voting with something…