Author: HackWatchit
Authored By Sakshi Jaiswal McAfee Labs recently observed a surge in phishing campaigns that use fake viral video links to trick users into downloading malware. The attack relies on social engineering, redirecting victims through multiple malicious websites before delivering the payload. Users are enticed with promises of exclusive content, ultimately leading them to fraudulent pages and deceptive download links. Figure 1: Geo Heatmap showing McAfee customer encounters over the past 3 weeks. Analysis 1. Upon executing the PDF file, the displayed page appears to be part of a phishing scam leveraging clickbait about a “viral video” to lure users into…
Being a digital forensics and incident response consultant is largely about unanswered questions. When we engage with a client, they know something bad happened or is happening, but they are uncertain of the “how, when, where, and why.” A significant component of our job is to tease out the “known knowns,” the “known unknowns,” and effectively and efficiently help the client answer the following: Have we been compromised? If “yes,” then: How long have we been compromised? (“dwell time”) What accounts and systems have been impacted?What was the method of compromise? (“patient zero”) What data was accessed and/or exfiltrated? In…
Industrial cybersecurity firm Dragos disclosed that the cybersecurity threat landscape in 2024 was heavily influenced by rising geopolitical tensions and their impact on industrial operations worldwide. Global geopolitical climate is driving increased concern for cybersecurity in industrial and critical infrastructure, as 2024 saw the expansion of adversaries, tools, and ransomware events targeting industrial organizations. It also reported the expansion of new adversaries that target critical infrastructure, connections between state and non-state actors, and internet-exposed ICS devices were among the most exploited vectors for OT-targeting attacks. The report, ‘OTICS Cybersecurity Report,’ published Tuesday, is Dragos’ eighth annual publication that examines the…
While working on internet-of-things security in the mid-2010s, Alex Zenla realized something troubling.Unlike PCs and servers that touted the latest, greatest processors, the puny chips in IoT devices couldn’t support the cloud protections other computers were using to keep them siloed and protected. As a result, most embedded devices were attached directly to the local network, potentially leaving them more vulnerable to attack. At the time, Zenla was a prodigious teen, working on IoT platforms and open source, and building community in Minecraft IRC channels. After puzzling over the problem for a few years, she started working on a technology…
EU sanctioned the leader of North Korea-linked APT groups Pierluigi Paganini February 25, 2025 The European Union sanctioned the leader of North Korea-linked APT groups for aiding Russia in its war against Ukraine. The European Union announced sanctions against entities aiding Russia in the ongoing conflict with Ukraine, including Lee Chang Ho, who is the leader of North Korea-linked APT groups. Lee Chang Ho coordinated North Korean soldiers in Ukraine and led North Korea-linked APT groups like Lazarus and Kimsuky, supporting actions against Ukraine’s independence. “Lee Chang Ho coordinated North Korean soldiers deployed on the battlefield in Ukraine, who may…
A malware campaign dubbed GitVenom uses hundreds of GitHub repositories to trick users into downloading info-stealers, remote access trojans (RATs), and clipboard hijackers to steal crypto and credentials. According to Kaspersky, GitVenom has been active for at least two years, targeting users globally but with an elevated focus on Russia, Brazil, and Turkey. “Over the course of the GitVenom campaign, the threat actors behind it have created hundreds of repositories on GitHub that contain fake projects with malicious code – for example, an automation instrument for interacting with Instagram accounts, a Telegram bot allowing to manage Bitcoin wallets, and a…
DISA Global Solutions, a Texas-based company that provides employment screening services (including drug and alcohol testing and background checks) for over 55,000 organizations, has suffered a cyber incident that led to a data breach, which resulted in the potential compromise of personal and financial information of over 3.3 million individuals. What is known about the breach? DISA discovered the breach on April 22, 2024, and the subsequent investigation revealed that an unauthorized third party accessed “a limited portion of their environment” on February 9, 2024. In between those dates, the threat actor had access to certain files. “Although our forensics…
Memory safety: Good. Cheese motion: Bad.The big debate over using Rust in the Linux kernel continues. After one of Linus Torvalds’ ALL CAPS interventions last week, kernel 2IC Greg Kroah-Hartman wades in with a please-and-thank-you follow-up.In case we were in any doubt, it’s now clear the memory-safe language is really happening in the Linux kernel. In today’s SB Blogwatch, we walk off sideways.Your humble blogwatcher curated these bloggy bits for your entertainment. Not to mention: 2024?Kernel Panic in the Rust BeltWhat’s the craic? Michael Larabel reports: Compelling Case For New Linux Kernel Drivers To Be Written In Rust“Rust rather than C”The debate over the…
Ethereum Foundation (EF) executive director Aya Miyaguchi will step down from her current role and transition into a new position as the foundation’s president amid a revamp of its leadership structure. Miyaguchi announced the change in a Feb. 25 statement and said a new governance model is expected soon. She added that her new role as president will focus on strengthening institutional relationships and expanding Ethereum’s (ETH) broader vision and culture. She described the transition as an opportunity to reflect on Ethereum’s decentralized ethos, especially in light of recent debates surrounding the network’s performance and ETH’s market value.She added that Ethereum’s…