Author: HackWatchit
A lot of emphasis and focus is put on the investigative part of SOC work, with the documentation and less glamorous side of things brushed under the rug. One such example is the simple SOC ticket: this could be internal or customer-facing, it could include a few sentences or paragraphs, it could contain everything necessary or be found lacking. I’m here to help you see your SOC tickets in a different light. There are a few core pieces to a good ticket, as well as some general criteria that must be met, whether that ticket is internal or external facing.…
North American drivers are continuing to be barraged by waves of scam text messages, telling them that they owe money on unpaid tolls.Last month we described on Hot for Security how US authorities had issued a warning about SMS phishing attacks from scammers posing as tolling agencies.For instance, Texas-based audience producer Gwen Howerton described on Bluesky how she had been duped by an unpaid toll scam after she had driven a rental car on the Dallas North Tollway – and, not being aware of the correct way to pay a toll, had believed the overdue payment demand she received to…
An active campaign from a threat actor potentially linked to Russia is targeting Microsoft 365 accounts of individuals at organizations of interest using device code phishing. The targets are in the government, NGO, IT services and technology, defense, telecommunications, health, and energy/oil and gas sectors in Europe, North America, Africa, and the Middle East. Microsoft Threat Intelligence Center tracks the threat actors behind the device code phishing campaign as ‘Storm-237’, Based on interests, victimology, and tradecraft, the researchers have medium confidence that the activity is associated with a nation-state operation that aligns with Russia’s interests. Device code phishing attacks Input constrained devices – those that lack…
Cyber security is at the heart of today’s digital revolution, yet it remains one of the most male-dominated sectors in science and technology. Data from Zippia shows that while women hold 48% of roles in the broader workforce, they represent only 24% of the cyber security workforce. In leadership, the numbers are similar —just 16% of cyber security industry vice presidents are women, yet some companies, like Check Point, have exceeded this by reaching 20% female VPs globally. This disparity isn’t just a pipeline problem—it’s also a perception problem. Girls and young women often don’t see cyber security as an…
Industrial cybersecurity company Dragos revealed that during the fourth quarter of 2024, the ransomware threat landscape presented an increasingly dynamic ecosystem, with multiple ransomware groups refining their techniques, expanding their capabilities, and forming new alliances, intensifying attacks on industrial organizations. The data revealed no new ransomware variants were designed for industrial control systems (ICS). However, ransomware attacks are still affecting industrial organizations, leading to operational disruptions such as forced production halts, manual failovers, and supply chain interruptions. “Throughout Q4 2024, newly branded or rebranded ransomware groups proliferated. Several leveraged leaked source code or formed partnerships with established adversaries, rapidly adopting…
Cybersecurity is a must as online threats rise. Businesses must train employees, back up data, and adopt strong security practices to prevent cyberattacks and data breaches. The Internet has provided businesses with endless opportunities to grow, expand into new markets, and operate more efficiently. However, it has also created new risks. Cybercriminals constantly look for ways to exploit vulnerabilities and steal sensitive data from both individuals and organizations. These attacks can cause financial losses and operational disruptions. Many businesses, especially smaller ones, assume they are not attractive targets for cybercriminals. In reality, cybercriminals frequently target them because they often lack…
Winter travel is filled with excitement—whether you’re heading to a snow-covered ski resort, visiting family for the holidays, or enjoying a cozy retreat in a picturesque town. According to Tripadvisor’s Winter Travel Index, 57% of Americans are gearing up for winter travel this year, with a staggering 96% planning to travel as much or more than they did last winter. Yet, with this seasonal joy comes a hidden danger: public Wi-Fi. Airports, hotels, coffee shops, and even ski lodges offer free Wi-Fi, making it easy to stay connected while on the go. But while these networks are convenient, they can…
U.S. CISA adds Apple iOS and iPadOS and Mitel SIP Phones flaws to its Known Exploited Vulnerabilities catalog Pierluigi Paganini February 15, 2025 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple iOS and iPadOS and Mitel SIP Phones vulnerabilities to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple iOS and iPadOS and Mitel SIP Phones vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The two vulnerabilities are: CVE-2025-24200 Apple iOS and iPadOS Incorrect Authorization Vulnerability CVE-2024-41710 Mitel SIP Phones Argument Injection Vulnerability This week Apple released emergency security updates to address a zero-day vulnerability, tracked…
Here’s a look at the most interesting products from the past week, featuring releases from Armor, EchoMark, Netwrix, Palo Alto Networks, and Socure. Palo Alto Networks Cortex Cloud applies AI-driven insights to reduce risk and prevent threats Palo Alto Networks introduced Cortex Cloud, the next version of Prisma Cloud, that brings together new releases of its cloud detection and response (CDR) and cloud native application protection platform (CNAPP) capabilities on the unified Cortex platform. Cortex Cloud is designed to ingest and analyze data from third-party tools to provide centralized visibility, AI-driven insights and end-to-end remediation across the entire cloud security…