Author: HackWatchit

A new global study from SANS and GIAC finds that the cybersecurity workforce crisis may be more misunderstood than ever. In a sharp break from headlines focused on unfilled roles, the 2025 Cybersecurity Workforce Research Report reveals that 52 percent of cybersecurity leaders say the real issue is not the number of people but the lack of the right people with the right skills. The study, based on insights from nearly 3,400 cybersecurity and HR managers, shows a clear shift in mindset. Organizations are no longer prioritizing headcount growth. Instead, they are investing in skills development, internal training, and more…

Few people truly understand the revolutionary shift unfolding before their eyes when it comes to AI. It’s not just that our tools and software have become smarter — it’s that we’ve started developing software in an entirely new way. This is understandable, of course, since there hasn’t been any dramatic change in either hardware or software. Our programs still run on digital CPUs and GPUs, and they’re still written in traditional programming languages like Python. So, where exactly is the revolutionary change?It’s worth taking a look at the source code of large language models like GPT-2, Grok, or Meta’s LLaMA.…

Cisco and Endace are providing SOC Services to RSAC™ 2025 Conference, monitoring traffic on the Moscone wireless network for security threats. Experts will be using Cisco Security Cloud in the SOC, with the power of Cisco Breach Protection Suite and User Protection Suite, and Secure Firewall; with Splunk Enterprise Security as the platform. The SOC is also providing network observability with ThousandEyes. Incidents are investigated with Threat Intelligence, provided by Cisco Talos and other partners, including Pulsedive, and alphaMountain.ai. We will also be using the Cloud Protection Suite to secure the SOC cloud infrastructure, along with Cisco Identity Intelligence and…

In business, trust is a make-or-break factor. It’s what holds customer relationships together. And it’s the quiet force that determines whether someone clicks “buy” or walks away from your website.  So how do you gain it?  You need to earn it. Trust isn’t something you can fake or sprinkle onto your company’s brand just by saying you care. It’s something you actively build, and it demands action. And that’s where Governance, Risk, and Compliance (GRC) comes into play. GRC is the strategic framework that helps businesses earn and sustain customer trust—because, when done right, it transforms how your business interacts…

Understanding Skills and Their Importance A skill is an individual’s ability to perform an action efficiently and effectively, providing a significant advantage in problem-solving. Skills go beyond mere knowledge, requiring: Time and effort to master Practical application in real-world scenarios Continuous refinement through experience A well-developed skill ensures that tasks are completed accurately and promptly. However, true expertise and innovation require years, sometimes decades, of dedicated practice and problem-solving. The Role of Training in Skill Development One of the most common ways to transfer skills is through training programs. These programs introduce participants to: Basic instructions on specific tasks Problem-solving…

LLMs’ tendency to “hallucinate” code packages that don’t exist could become the basis for a new type of supply chain attack dubbed “slopsquatting” (courtesy of Seth Larson, Security Developer-in-Residence at the Python Software Foundation). A known occurrence Many software developers nowadays use large language models (LLMs) to help with their programming. And, unfortunately, LLMs’ known tendency to spit out fabrications and confidently present them as facts when asked questions on various topics extends to coding. This has been known for a while. A number of researchers have previously noticed that LLMs occasionally recommend non-existent software libraries and packages, and posited…

Microsoft says some users might see 0x80070643 installation failures when trying to deploy the April 2025 Windows Recovery Environment (WinRE) updates. The known issue impacts the KB5057589 WinRE update on Windows 10, versions 22H2 and 21H2, and KB5057588 on Windows Server 2022 systems. However, as Redmond told those affected, these installation errors can be ignored since they are inaccurate and don’t impact the functionality of the Windows device. “After installing the April 2025 Windows Recovery Environment update [KB5057588], you might see the following error message in the Windows Update settings page: 0x80070643 – ERROR_INSTALL_FAILURE. This error message is not accurate…

Ray Felch // Introduction Continuing with my ongoing Smart Lock attack research (see blog Reverse Engineering a Smart Lock), I decided to move my focus to a different type of attack technique, namely a relay attack. The relay attack is a form of MitM attack, not to be confused with the more well-known replay attack.   MitM attacks commonly involve intercepting data between two parties in order to view/modify that data before relaying it on to the intended recipient. MitM attacks consist of controlling the back-and-forth communication between the two unsuspecting parties. The parties think that they are talking to each…

Tycoon2FA phishing kit rolled out significant updates Pierluigi Paganini April 14, 2025 The operators of the Phishing-as-a-Service (PhaaS) platform Tycoon2FA have rolled out significant updates to enhance its evasion capabilities. Tycoon2FA, a phishing kit discovered in 2023 by cybersecurity firm Sekoia, was recently updated to improve its evasion capabilities. The phishing kit now uses advanced evasion tactics such as a custom CAPTCHA via HTML5 canvas, invisible Unicode in obfuscated JavaScript, and anti-debugging scripts to bypass detection and hinder analysis. “Lately, the Tycoon 2FA landing pages have incorporated a clever obfuscation technique using invisible Unicode characters. This technique, when paired with…