Author: HackWatchit
The U.S. House Committee on Homeland Security has released an updated ‘China Threat Snapshot’ report, which examines Chinese cyber espionage and intellectual property theft. This update is part of the committee’s renewed efforts to oversee the protection of U.S. intellectual property, ports, and critical infrastructure. The report highlights over 60 instances of espionage by the Chinese Communist Party (CCP) on U.S. soil over the past four years, including cases of transmission of sensitive military information, theft of trade secrets, transnational repression operations, and obstruction of justice. “The PRC has gained significant ground in its information warfare on American soil over…
MetricStream has unveiled its annual forecast of key trends shaping the future of GRC and Cyber GRC. These 2025 predictions offer a roadmap for building resilience strategies, addressing emerging risks, and seizing new opportunities. AI comes of age: risks, rewards, and governance The rise of AI continues to revolutionize GRC for organizations with agentic automation, recommendations, and intelligent insights while amplifying the demand for governance to safeguard data, maintain trust, and ensure the ethical use of AI. Resilience takes center stage Global disruptions, from cyberattacks to supply chain breakdowns, underscore the criticality of resilience. Regulations like the UK Operational Resilience…
It’s been a while since we’ve written about card skimmers, which used to play a big part in global cybercrime. These days, many if not most cyber-breach and cybercrime stories revolve around ransomware, the darkweb and the cloud, or some unholy combination of the three. In ransomware attacks, the criminals don’t actually need to approach the scene of the crime in person, and their payoffs are extracted online, typically using pseudoanonymous technologies such as the darkweb and cryptocoins. And in some cloud-based cybercrimes, notably those generally referred to as supply-chain attacks, the criminals don’t even need to access your network…
Researchers propose fresh approaches to cloud-security bugs and mitigating exposure, impact and risk.
This webcast was originally published on October 24, 2024. In this video, experts delve into the intricacies of desktop application penetration testing methodologies. They discuss various techniques to thoroughly evaluate application security, including memory analysis, DLL hijacking, and network analysis. The conversation also highlights the importance of creating a comprehensive testing strategy and the value of documenting findings during the testing process. The webinar discussed a comprehensive approach to pen testing desktop applications, emphasizing the importance of understanding the application thoroughly before diving into complex reverse engineering tasks. The presenter advocates for a detailed scoping process during a pen test…
Brushing scams are a type of online fraud where sellers send unsolicited packages to individuals, even though they never made an order. These deceptive tactics are often used on popular e-commerce platforms such as Amazon and AliExpress. The goal of scammers is to artificially inflate product rankings and create fake reviews, ultimately boosting their sales and visibility. Read on to understand how brushing scams work and what steps you can take to stay safe. What Is a Brushing Scam? A brushing scam is a fraudulent practice in which sellers send packages to people without their knowledge or consent. These items…
Regardless of job title, 92% of executives stated they had some degree of confidence in their organization’s ability to meet compliance requirements and tackle advanced threats with current staff and tools, but confidence levels differed across leadership roles, according to Cyber Defense Group. CEOs express high confidence in their organization’s security strategies 68% of CEO respondents reported being very confident in their organization’s security posture, likely stemming from their direct involvement in hiring security leaders and shaping overarching strategies. However, CEOs’ disconnect from the day-to-day realities of threat data and security responses may create a gap in their understanding. On…
On February 11, President Donald J. Trump announced a new President’s Intelligence Advisory Board (PIAB). This board will advise the President on the nation’s pressing security challenges, ensuring the Intelligence Community acts with integrity to uphold the America First agenda. He selected “a distinguished and trusted group of Patriots” with extensive professional experience according to the Presidential Action. The following individuals have been appointed to the PIAB: Devin Gerald Nunes, Chair: Mr. Nunes served in the U.S. House of Representatives for the state of California from 2003 to 2022. He was awarded the Presidential Medal of Freedom by President Donald…
U.S. CISA adds SimpleHelp flaw to its Known Exploited Vulnerabilities catalog Pierluigi Paganini February 14, 2025 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SimpleHelp vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SimpleHelp vulnerability, tracked as CVE-2024-57727, to its Known Exploited Vulnerabilities (KEV) catalog. At the end of January, Horizon3 researchers discovered three vulnerabilities, tracked as CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728, that could be used to compromise a SimpleHelp server, as well as clients machines being managed by SimpleHelp. The first vulnerability, CVE-2024-57727 (CVSS score of 7.5), is an unauthenticated path traversal issue allowing attackers…