Author: HackWatchit

A large botnet targets M365 accounts with password spraying attacks Pierluigi Paganini February 24, 2025 A botnet of 130,000+ devices is attacking Microsoft 365 accounts via password-spraying, bypassing MFA by exploiting basic authentication. SecurityScorecard researchers discovered a botnet of over 130,000 devices that is conducting password-spray attacks against Microsoft 365 (M365) accounts worldwide. The attackers targeted accounts protected with basic authentication bypassing multi-factor authentication. The experts pointed out that organizations relying solely on interactive sign-in monitoring areblind to these attacks. Basic Authentication allows credentials to be transmitted in plain form, allowing attackers to steal them. Despite Microsoft phasing it out,…

Not all VPNs are suitable for torrenting. Some VPNs allow torrenting on all servers, some only on specific servers, and some even block torrenting entirely. What’s more, although some VPNs allow torrenting, that doesn’t make them entirely suitable for it. For example, you may find that the VPN in question logs identifying data, which could open you up to legal consequences. Or it may be that your VPN is too slow for torrenting to be viable. With this in mind, we’ll take a close look at Private Internet Access (PIA), a popular VPN provider that allows torrenting. We’ll explore whether…

As we head into a season filled with moments that matter to consumers – from the upcoming U.S. election to the holiday shopping rush – online safety is more important than ever. With AI-generated content on the rise and scammers able to carry out more sophisticated scams, it’s crucial to stay vigilant and ensure you’re fully protected. If you’ve ever thought, “is that text message really from my bank?” Or “I don’t want my personal life to be available to people I don’t know on my social media?” McAfee+ can help you. This autumn, McAfee has introduced a set of…

Russia’s National Coordination Center for Computer Incidents (NKTsKI) is warning organizations in the country’s credit and financial sector about a breach at LANIT, a major Russian IT service and software provider. According to the bulletin, which was also published on the website of GosSOPKA (State System for Detection, Prevention, and Elimination of Consequences of Computer Attacks), the attack took place on February 21, 2025, and potentially impacted LLC LANTER and LLC LAN ATMservice, both part of the LANIT Group of Companies. LANIT Group is a significant and influential company in Russia’s information technology sector, considered the country’s largest system integrator. Its…

Account takeover (ATO) is one of the most prevalent attack types; Proofpoint says that in 2024, 99% of the customer tenants the company monitors were hit with at least one account takeover attempt, and 62% of the customers experienced at least one that was successful. “We have thousands of direct integrations with key cloud services such as Microsoft Entra ID, O365, Okta and Google Workspace as well as tens-of-millions of monitored user accounts,” the company’s threat researchers explained. On average, affected organizations have had 12 accounts compromised by attackers last year, they added, and some organizations experienced dozens or hundreds…

If you’ve been on a website and noticed one of the following features, there’s a good chance you’ve stumbled upon a hot spot for server-side request forgery (SSRF) bugs:  Print a certificate of completion  Generate a report  Submit a digital signature  Before getting into the nuts ‘n’ bolts of how to find and exploit SSRF bugs in PDF generators, let’s go through a quick thought experiment. I want to give you a simple mental snapshot of what is going on when a PDF is generated in a web application. Imagine that you saved a very basic web page into an…

A proof-of-concept (PoC) exploit for four critical Ivanti Endpoint Manager vulnerabilities has been released by Horizon3.ai researchers. The vulnerabilities – CVE-2024-10811, CVE-2024-13161, CVE-2024-13160 and CVE-2024-13159 – may be exploited by remote, unauthenticated attackers to leverage Ivanti EPM machine account credentials for relay attacks and, ultimately, to compromise the Ivanti EPM server. “Compromising the Endpoint Manager server itself would lead to the ability to compromise all of the EPM clients, making this avenue especially impactful,” Horizon3.ai researcher Zach Hanley explained last week, though he also noted that the impact of the exploitation would depend on the targeted environment. The vulnerabilities CVE-2024-10811,…

The European Commission unveiled on Monday a proposal aimed at ensuring a robust and efficient response to large-scale cyber incidents, thereby enhancing EU cyber crisis coordination. The updated cybersecurity blueprint refines the comprehensive EU framework for Cybersecurity Crisis Management, detailing the roles of relevant EU actors throughout the entire crisis lifecycle. The draft Council Recommendation on the EU Blueprint for cybersecurity crisis management also seeks to present the EU framework in a clear, straightforward, and accessible manner. A non-binding instrument that identifies specific actions in a cyber crisis and which can enhance the overall effectiveness of the cyber crisis management…

In 2014, Jason Frantz and Rob Woollen co-founded Sigma Computing, a platform that overlays data stored in data platforms such as Snowflake and Google BigQuery with a spreadsheet-like interface for data visualization and analytics. With Sigma, the two former software engineers sought to tackle what they perceived as the intractable data challenges faced by large corporations: unwieldy tooling and difficult-to-manage data stores. In a 2023 survey from Oracle, the majority of business leaders said that they don’t believe their employer’s current approach to data and analytics is addressing their needs. Seventy-seven percent said that the dashboards and charts they get…