Author: HackWatchit

On March 12, 2025, The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released a Cybersecurity Advisory (CSA) to disseminate known Medusa ransomware IOCs and TTPs that have been identified through FBI investigations as recently as February 2025. This joint CSA is a continuation of CISA’s ongoing #StopRansomware effort to arm defenders with the intelligence they need to combat different ransomware variants and ransomware threat actors. Medusa is a Ransomware-as-a-Service (RaaS) operation that has been active since June 2021 targeting Windows-based environments. At the time of writing, Medusa…

Kent Ickler // It’s been over two years since Jordan and I talked about a Blue Team’s perspective on Red Team tools.   A Blue Team’s Perspective on Red Team Hack Tools – YouTube  The webcast itself had interesting topics; at the end of the discussion, we talked about a tool we wrote. PlumHound is a report engine for BloodHoundAD to make actionable reports for Blue Teams, Systems Administrators, and Analysts. We figured it’s about time we got around to writing this blog.  The framework for PlumHound is relatively simple: utilize the control path-finding capabilities of BloodHoundAD in Neo4j to build actionable…

Bolivia has authorized its state-run energy company, YPFB, to use crypto for fuel imports as the country struggles with a worsening dollar shortage and fuel crisis.The government approved the move to sustain fuel subsidies and secure essential energy supplies amid declining foreign currency reserves.Gas stations across Bolivia have seen long lines as fuel shortages persist. Protests have erupted in several regions as citizens face growing difficulties in accessing fuel.Years of declining natural gas production and dwindling exports have forced Bolivia to rely more on imports, but a lack of dollars has complicated payments to foreign suppliers.A YPFB spokesperson confirmed that…

Introduction: The Escalating Economic Threat of Cybercrime Cybercrime is no longer just an IT problem—it has evolved into a global economic crisis, affecting corporations, governments, and individuals alike. With increasing ransomware attacks, nation-state cyberwarfare, and financial fraud, the total global cost of cybercrime is projected to reach $1.2 trillion annually by the end of 2025. Unlike exaggerated claims of $10+ trillion in cybercrime damages, this article presents a realistic, data-driven estimate based on FBI IC3 reports, business losses, brand reputation damage, and cyber insurance payouts. Breaking Down the Global Cost of Cybercrime (2025 Projection) 1. Direct Financial Losses: $150B –…

When it comes to safeguarding your privacy online, most people focus on securing passwords, encrypting communications, and clearing browsing history. While these practices are essential, they overlook one important element—metadata. This data, which is collected about your digital interactions, can often reveal more about you than you think. Metadata is an invaluable resource for online trackers, advertisers, cybercriminals, and even government surveillance. Understanding how metadata is collected and what you can do to protect it is critical for preserving your personal privacy. What is metadata? At its core, metadata is data about data. It provides context and additional information about…

The Hague, the Netherlands, March 13th, 2025, CyberNewsWire Founded in 2024, Modat – the European-crafted, research-driven, AI-powered cybersecurity company, has announced the launch of its premier product, Modat Magnify.    Designed by and for cybersecurity professionals, the team behind the product aims to speed up the lives of these individuals easier by giving them access to the largest Internet ‘Device DNA’ dataset available. The ‘Device DNA’ catalogues the essential attributes of each internet-connected device to create a unique profile. FAST. AI-powered for unparalleled speed. Continuously scanning the entire internet and identify adversary infrastructure in real-time.  SMART. Research enhances the development of…

The departures have strained a workforce that was already stretched thin. “We were running into [a] critical skills shortage previously,” says a second employee. “Most people are and have been doing the work of two or more full-time [staffers].”The CISA team that helps critical infrastructure operators respond to hacks has been understaffed for years. The agency added support positions for that team after a Government Accountability Office audit, but “most of those people got terminated,” a third employee says.CISA’s flagship programs have been mostly unscathed so far. That includes the threat-hunting branch, which analyzes threats, searches government networks for intruders,…

February 2025 saw a record 126% surge in ransomware attacks, with Cl0p leading the charge. Hackers exploited file transfer flaws, infostealers, and AI-driven tactics, reveals Bitdefender’s latest Threat Debrief report. Cybersecurity just reached a new milestone; and not in a good way. According to Bitdefender’s latest Threat Debrief report, February 2025 was the worst month in history for ransomware attacks, with a 126% increase in claimed victims compared to the same period last year. This surprising jump saw the number of victims soar from 425 in February 2024 to a staggering 962 in February 2025. The massive surge in ransomware…

North Korea-linked APT group ScarCruft spotted using new Android spyware KoSpy Pierluigi Paganini March 13, 2025 North Korea-linked APT group ScarCruft used a new Android spyware dubbed KoSpy to target Korean and English-speaking users. North Korea-linked threat actor ScarCruft (aka APT37, Reaper, and Group123) is behind a previously undetected Android surveillance tool named KoSpy that was used to target Korean and English-speaking users. ScarCruft has been active since at least 2012, it made the headlines in early February 2018 when researchers revealed that the APT group leveraged a zero-day vulnerability in Adobe Flash Player to deliver malware to South Korean users. Kaspersky first documented the operations of the group in 2016.…