Author: HackWatchit

Should we negotiate? Should we pay? These are the questions every organization faces when cybercriminals lock their data. By the time attackers have encrypted your systems, the focus shifts from prevention to response. It’s no longer about how it happened, it’s about what you’re willing to do next. Ransomware gangs are becoming more organized and aggressive, and many now operate like businesses. They have customer service, payment portals, and negotiation playbooks. No organization is off-limits. Hospitals, schools, critical infrastructure, and global companies have all been hit. A Zscaler report suggests that the massive $75 million ransom paid to the Dark…

OpenAI has launched three new reasoning models – o3, o4-mini, and o4-mini-high for Plus and Pro subscribers, but as it turns out, these models also have usage limitations. In a support document, OpenAI shed light on how you can use ChatGPT’s three new reasoning models. If you subscribe to ChatGPT Plus, you’ll get up to 50 messages per week for the o3 model, which is the most powerful reasoning model. ChatGPT Plus with model selection Source: BleepingComputer On the other hand, o4-mini offers 150 messages per day and o4-mini-high (best for coding) offers 50 messages per day. These limitations are only…

In brief Canary Capital is seeking approval to launch a U.S. ETF based around Tron (TRX). The proposed product would include staking benefits for investors. Canary has also filed to launch XRP, Solana, Sui, and Pudgy Penguins ETFs. The ETF applications keep coming. Canary Capital on Friday filed an S-1 prospectus with the U.S. Securities and Exchange Commission on Friday for a spot Tron ETF that would include staking capabilities. The staking feature of the Canary Staked TRX ETF would allow investors to earn extra yield with their investment. The fund’s “investment objective is to seek to provide exposure to the price…

Here at Ignyte, we talk a lot about various overarching information security frameworks, like FedRAMP, CMMC, and ISO 27001. Within these overall frameworks exist a range of smaller and narrower standards, including COMSEC. If you’ve seen COMSEC as a term, you may be passingly familiar with what it is, but if you need to know the details, it’s surprisingly muddy to identify with specificity. So, we decided to talk about it. What is COMSEC? COMSEC is simply an abbreviation – not an acronym – for Communications Security. It applies to a range of different departments and institutions, and many of…

Join the BHIS Discord discussion server: https://discord.gg/aHHh3u5 We’re really excited to have a close member of our BHIS extended family, Tim Medin from Red Siege InfoSec, here for a webcast on Kerberos & Attacks 101. Tim is the creator of Kerberoasting. Want to understand how Kerberos works? Would you like to understand modern Kerberos attacks? If so, then join Tim Medin as he walks you through how to attack Kerberos with ticket attacks and Kerberoasting. We’ll cover the basics of Kerberos authentication and then show you how the trust model can be exploited for persistence, pivoting, and privilege escalation. 0:00…

Hertz confirms data breach linked to Cleo software flaw; Cl0p ransomware group leaked stolen data, exposing names, driver’s licenses, and credit card details. Car rental company Hertz has announced that some of its customers’ private details were accessed without permission. This happened because of vulnerabilities in Cleo Communications US, LLC (Cleo), a company that provides software services to Hertz.   It is worth noting that in December 2024, the Cl0p ransomware group claimed responsibility for exploiting vulnerabilities in Cleo’s managed file transfer software, leading to the theft of large amounts of corporate data. A few days later, the group published…

DeepSeek represents a profound threat to our nation’s security, according to a report from The Select Committee on the Chinese Communist Party. Although it presents itself as just another AI chatbot, offering users a way to generate text and answer questions, closer inspection reveals that the app siphons data back to the People’s Republic of China (PRC), creates security vulnerabilities for its users, and relies on a model that covertly censors and manipulates information pursuant to Chinese law. Equally troubling, the model appears to have been built using stolen U.S. technology on the back of U.S. semiconductor chips that are…

Frenos, an autonomous OT security assessment platform company, announced the appointment of Colin Murphy as its chief hacking officer. Murphy brings over a decade of expertise as a recognized cybersecurity researcher, practitioner and technology innovator, including his most recent role as CIO for KnowBe4, where he helped guide the company from startup to its $1 billion unicorn status, IPO and subsequent private equity acquisition.  Murphy’s appointment as Chief Hacking Officer marks a return to his roots as an ethical hacker, building on years of red teaming experience alongside the late Kevin Mitnick at Mitnick Security, where he continues to collaborate…

In this Help Net Security interview, Dr. Dag Flachet, co-founder at Codific, explains what the Cyber Resilience Act (CRA) means for companies and how it compares to GDPR in terms of regulatory complexity and impact on organizations. He discusses the technical and procedural challenges posed by CRA, particularly in secure software development, and highlights the role of frameworks like OWASP SAMM in conducting readiness assessments. In your view, how does the CRA compare to GDPR in terms of regulatory impact and complexity for organizations? Can you elaborate on what that impact looks like in practical terms for organizations? Under GDPR…