Author: HackWatchit

25 Oct 2022 How to Play Competitive Backdoors & Breaches w/ Jason Blanchard (1-Hour) Webcast: Looking for Needles in Needlestacks w/ Threat Hunting Toolkit Looking For Something?Browse by category Select Category Alyssa Snow  (7) Ashley Knowles  (1) Ashley Van Hoesen  (1) Author  (402) Backdoors & Breaches  (7) Beau Bullock  (32) Ben Bowman  (1) Ben Burkhart  (1) Blue Team  (101) Blue Team Tools  (40) Brian Fehrman  (18) Brian Ireland  (1) Brian King  (20) Bronwen Aker  (1) C2  (29) Cameron Cartier  (2) Carrie Roberts  (5) Chris Sullo  (1) Chris Traynor  (2) CJ Cox  (8) Connor Costigan  (1) Corey Ham  (4) Craig Vincent  (2) Dale Hobbs  (3) Daniel Pizarro  (1) Darin Roberts  (1) Dave Blandford  (2) David Fletcher  (30) David Perez  (1) Deb Wigley  (1) Debjeet Banerjee  (1) Derek Banks  (13) Derrick Rauch  (1) DFIR  (1) DNSTAP  (1)…

Whether you’re downloading a video from YouTube or converting a Word document into a PDF file, there’s a chance that you might be unwittingly handing your personal information straight into the hands of cybercriminals.That’s the warning that has been issued by the FBI, whose Denver Field Office raised the alarm about the danger of boobytrapped file-conversion tools being used to spread malware.For many users it’s not that unusual to search the web for a free tool to convert an image file from one file format to another – such as a Word document to a PDF, a spreadsheet to a…

A phishing campaign targeting GitHub account owners has been trying to scare them with a fake security alert into allowing a malicious OAuth app access to their account and repositories. The fake security alert from GitHub GitHub users have taken to social media to warn others about emails ostensibly coming from the GitHub Security Team, alerting recipients about an “unusual access attempt” from an IP address/device located in Reykjavik, Iceland. The attackers mounted this campaign by creating a GitHub issue containing the fake security alert, then relying on GitHub to automatically send notification emails to the project maintainers. The malicious…

Frankfurt am Main, Germany, March 17th, 2025, CyberNewsWire Cyberattacks are no longer an abstract threat – they dominate risk planning for companies worldwide. The latest Link11 European Cyber Report shows an alarming trend: the number of DDoS attacks has more than doubled, and they are shorter, more targeted, and more technically sophisticated. Organizations that do not continuously evolve their security strategies face significant financial losses and long-term reputational damage.  The numbers speak for themselves:  137% more DDoS attacks on the Link11 network compared to last year. A new scale has been reached: The largest attack measured to date was 1.4…

Frankfurt am Main, Germany, March 17th, 2025, CyberNewsWire Cyberattacks are no longer an abstract threat – they dominate risk planning for companies worldwide. The latest Link11 European Cyber Report shows an alarming trend: the number of DDoS attacks has more than doubled, and they are shorter, more targeted, and more technically sophisticated. Organizations that do not continuously evolve their security strategies face significant financial losses and long-term reputational damage.  The numbers speak for themselves:  137% more DDoS attacks on the Link11 network compared to last year. A new scale has been reached: The largest attack measured to date was 1.4…

25 Oct 2022 Webcast: Getting Started in Covert .NET Tradecraft for Post-Exploitation – Kyle Avery Webcast: Modern C2 and Data Exfiltration w/ Kyle Avery Looking For Something?Browse by category Select Category Alyssa Snow  (7) Ashley Knowles  (1) Ashley Van Hoesen  (1) Author  (402) Backdoors & Breaches  (7) Beau Bullock  (32) Ben Bowman  (1) Ben Burkhart  (1) Blue Team  (101) Blue Team Tools  (40) Brian Fehrman  (18) Brian Ireland  (1) Brian King  (20) Bronwen Aker  (1) C2  (29) Cameron Cartier  (2) Carrie Roberts  (5) Chris Sullo  (1) Chris Traynor  (2) CJ Cox  (8) Connor Costigan  (1) Corey Ham  (4) Craig Vincent  (2) Dale Hobbs  (3) Daniel Pizarro  (1) Darin Roberts  (1) Dave Blandford  (2) David Fletcher  (30) David Perez  (1) Deb Wigley  (1) Debjeet Banerjee  (1) Derek Banks  (13) Derrick Rauch  (1) DFIR  (1) DNSTAP  (1)…

Key Takeaways: A detonation of just 110 kilotons could immediately jeopardize approximately 20% of LEO satellites. Radiation clouds from such detonations could persist for years. Commercially viable hardening solutions don’t exist. IMPACT: Crippling communications and navigation systems; preventing satellite replacement and recovery; and creating a fundamental security vulnerability. RAND evaluated how nuclear explosions in space and near-space environments could affect non-military satellites. The emphasis was on low-Earth orbit (LEO; an altitude of ≤1,200 miles or 2,000 kilometers), where most satellites reside. With the United States increasingly dependent on satellites for communications, navigation, weather forecasting, and more, this critical space-based infrastructure…

Ransomware negotiations are a high-stakes game where every decision matters. In this Help Net Security video, Kurtis Minder, CEO at GroupSense, takes us inside the world of ransomware negotiations. We learn how attackers communicate, the tough decisions victims face, and the mistakes that can make or break a response. He breaks down the key factors in deciding whether to engage with hackers, the legal and ethical considerations, and why preparation is everything. Learn why logging practices, pre-planned communication, and working with professional responders are essential for navigating these cyber extortion crises.

Cybercriminals are promoting malicious Microsoft OAuth apps that masquerade as Adobe and DocuSign apps to deliver malware and steal Microsoft 365 accounts credentials. The campaigns were discovered by Proofpoint researchers, who characterized them as “highly targeted” in a thread on X. The malicious OAuth apps in this campaign are impersonating Adobe Drive, Adobe Drive X, Adobe Acrobat, and DocuSign. Malicious OAuth appsSource: Proofpoint These apps request access to less sensitive permissions such as ‘profile’, ’email’, and ‘openid,’ to avoid detection and suspicion. If those permissions are granted, the attacker is given access to: profile – Full name, User ID, Profile picture, Username …