Author: HackWatchit

Over 16,000 internet-exposed Fortinet devices have been detected as compromised with a new symlink backdoor that allows read-only access to sensitive files on previously compromised devices. This exposure is being reported by threat monitoring platform The Shadowserver Foundation, which initially reported 14,000 devices were exposed. Today, Shadowserver’s Piotr Kijewski told BleepingComputer that the cybersecurity organization now detects 16,620 devices impacted by the recently revealed persistence mechanism. Last week, Fortinet warned customers that they had discovered a new persistence mechanism used by a threat actor to retain read-only remote access to files in the root filesystem of previously compromised but now patched…

moth & James Marrs // Introduction After a month of hard work, Python headaches, dependency hell, and a bit of tool necromancy, ADHD4 is here and we’re thrilled to share it with the community! This version features tools upgraded from Python 2 to Python 3, a fancy new applications menu, updated/reorganized documentation, and more. What’s This? ADHD stands for Active Defense Harbinger Distribution. The driving idea of this security image is to actively defend your environment from a malicious attacker. Want to leave an attacker clueless as to what ports are open? ADHD has a tool for that. Want to…

In the ever-evolving cybersecurity landscape, one age-old vulnerability continues to haunt individuals and organizations alike: passwords. From weak or reused credentials to phishing and brute-force attacks, traditional password-based authentication has proven to be a persistent weak link in the digital defense chain. This has led many experts and enterprises to explore a bold new frontier—passwordless authentication. But can going passwordless really help thwart major cyber threats? The answer, increasingly, appears to be yes—with the right implementation. The Problem with Passwords Passwords were once a simple solution to secure access. But as cyberattacks grow more sophisticated, they have become a liability.…

A cybersecurity firm is buying access to underground crime forums to gather intelligence. Does that seem daft to you? And over in Nigeria, even if romance scammers would like to update their LinkedIn profiles, just how easy is it to turn a new leaf after a sweet-talking career in cybercrime? All this and more is discussed in the latest edition of the award-winning “Smashing Security” podcast by computer security veterans Graham Cluley and Carole Theriault. Warning: This podcast may contain nuts, adult themes, and rude language. Hosts: Graham Cluley:  @grahamcluley.com  @[email protected] Carole Theriault:  @caroletheriault Episode links: Sponsored by: Dashlane –…

MITRE avoids CVE program shutdown with last-minute contract extension. Questions remain about long-term funding and the future of vulnerability tracking. MITRE’s role in managing the CVE (Common Vulnerabilities and Exposures) program will continue, thanks to a last-minute contract extension confirmed this week. While the immediate risk of disruption has been avoided, the situation raised concerns about the long-term stability of the program and how critical infrastructure like CVE is supported going forward. A Last-Minute Reprieve On April 15, MITRE sent a letter to CVE Board members warning that its current contract to manage CVE and related efforts such as CWE…

Are you concerned about protecting all your home devices with a VPN without installing software on each one? Are you looking to bypass geo-restrictions for your entire network at once? Many home network users ask: Can I install ExpressVPN on my TP-Link router? Which TP-Link models are compatible? Will it slow down my internet connection? And is the setup process too technical for non-IT people? This comprehensive guide answers these questions and walks you through setting up ExpressVPN on your TP-Link router to simultaneously secure all your connected devices. How does ExpressVPN on a router work? ExpressVPN is a premium…

APT29 (aka Cozy Bear, aka Midnight Blizzard) is, once again, targeting European diplomats with fake invitations to wine-tasting events, Check Point researchers have shared. Cozy Bear uses wine-tastings and dinners as a lure In early 2024, Zscaler flagged a low-volume phishing campaign aimed at delivering the WINELOADER backdoor to European diplomats. The lure was a PDF file containing a fake invitation letter supposedly send by the Ambassador of India, inviting diplomats to a wine-tasting event. Around the same time, German political parties were similarly targeted with fake invitations to a dinner reception, apparently sent by the Christian Democratic Union (CDU).…

The Common Vulnerabilities and Exposures (CVE) program has long served as the foundation for standardized vulnerability disclosure and management, enabling effective communication and remediation strategies across the industry. As the cybersecurity community grapples with a potential lapse in the stewardship of the CVE program, organizations worldwide could face challenges in maintaining consistent vulnerability identification and tracking, especially in open-source software. Cisco’s Commitment to Transparent Vulnerability Disclosure Cisco is committed to transparency and vulnerability disclosure practices that do not solely rely on the CVE program. Cisco’s Product Security Incident Response Team (PSIRT) was created long before CVE was established and is…

Jordan Drysdale & Kent Ickler // Jordan and Kent are back again to continue strengthening organizations’ information security human capital (That’s all you folks!). Organization Leadership and Security Practitioners can gain understanding on the potential designed-to-fail Purple Teams initiatives never reached their full potential. The Duo reviews how systemic organizational career pathing created an insoluble Red vs Blue dichotomy. MORE IMPORTANTLY: The team is announcing a recipe for Purple Team Wins: The Atomic Purple Team (Lifecycle) Framework Organizations struggling to efficiently leverage the skillsets of all information security staff will benefit from considering the Atomic Purple Team Lifecycle Framework’s business-driven…