Pendergrass Consulting

09/03/2026

We’re building the team for 9/17.

Pendergrass Consulting is recruiting Blue Team CTF Operators for HTB Holmes 2026 — a global defensive cybersecurity competition built around investigation, detection, forensics, threat hunting, and problem solving.

We’re looking for builders, breakers, and operators who can think under EXTREME pressure, communicate with a team, follow the evidence, and figure out what others miss.

Our objective: compete hard and make another run at the Top 10.

There’s also a $7,000 prize pool on the line.

Not looking for tourists -- you don’t need to know everything. You do need to know how things work curiosity, persistence, strong problem-solving instincts, and the willingness to contribute under extreme pressure when the clock is ticking things are going wrong and everyone is counting on you.

We call this fun! Interested in joining the operation?

Go to: https://pendergrassconsulting.com/contact/

Complete the form choose: Red Team Operations

Submit your resume for faster onboarding.

The brief is waiting.

08/28/2026

‼️ On the morning of December 29, a steam turbine at a Polish power plant serving 50,000 people just... stopped. So did the system treating the plant's water.

It took investigators THREE MONTHS to piece together what happened — and what they found had never been documented in a real-world attack before.

The hackers didn't break into the power plant.

They broke into a WIND FARM. A totally separate company, miles away. And then they walked from the wind farm straight into the power plant — through a shared network that NEITHER facility owned or controlled.

Here's the path, and the shape of it is the whole lesson:
🔌 They got into the wind farm through an internet-facing security device that had no multi-factor authentication (the guard at the gate was an open door)
📡 They hopped onto a small cellular router there and opened a hidden tunnel onto a private network the regional grid operator ran to connect its energy sites
🚪 That shared network let ANY device talk to ANY other device — so the wind farm had an open path to the power plant
🕵️ They crept around quietly for a week and a half (using a controller left on its default factory password as a stepping stone)
💥 Then they switched the plant's core controllers to "stop" and locked them with a password — halting the turbine and water treatment
🧹 On the way out they wiped their tracks, even bricking one controller so it wouldn't reboot

Investigators said it's the first time they've EVER seen a real attack reach industrial controls by crossing a shared network like this.

👉 And here's why it matters to YOUR business, even though you don't run a power plant. This is a story about TRUSTED CONNECTIONS — the links between your business and others that exist for good reasons and that nobody ever thinks about as a risk:

• The vendor who has remote access into your systems to service your equipment
• The managed device in your closet that an outside company installed and told you not to touch
• The shared portal with a partner or supplier
• The link a tech set up years ago between your shop and your warehouse

Every one of those is a door someone else may hold a key to — or a road a breach at another company could travel down straight into you. The plant did plenty right internally and STILL got hit, because the danger came through a side door connected to a neighbor, over a road someone else built.

The two openings that made it all possible? No multi-factor authentication, and an unchanged default password. Same two we mention almost every week.

Full breakdown: https://www.pendergrassconsulting.com/how-hackers-reached-a-power-plant-through-a-wind-farm-the-trusted-connection-risk-in-your-business/

We'll map every road that leads into your business — including the vendor connections you've stopped noticing: https://www.pendergrassconsulting.com/contact/

A power plant was breached through a separate wind farm and a shared network that neither company controlled. The trusted-connection lesson for your business.

08/27/2026

‼️ For months, officials warned it was coming. Now it looks like it's happened: a cyberattack knocked a small British power plant offline for FOUR DAYS this summer — right after a wave of attacks hit more than 30 community water systems here in the US.

British security officials link the power-plant attack to hackers connected to Iran. US authorities connect the water attacks to the same source.

But here's the thread that ties it all together, and it's the reason I'm sharing this with every small business owner I know: 👇

The targets weren't massive national power grids. They weren't giant utilities with huge security teams.

They were SMALL. The generator? A UK official literally called it "tiny." The water systems? Small-town community utilities.

These attacks didn't succeed by overpowering the strongest defenses. They succeeded by finding the WEAKEST — the small, under-resourced, lightly-defended facilities everyone assumed were too minor to bother with.

If that sounds a lot like most small businesses... it should. 🎯

Here's why they go after the small ones: when you want to cause disruption but can't punch through a major, well-defended grid, you look for a softer way in. And small facilities offer exactly that — a way to cause real disruption without having to beat the big, hardened targets. They're the path of least resistance.

What makes them reachable is something they share with a HUGE number of ordinary businesses: they rely on internet-connected systems that let people monitor and control equipment remotely. That remote convenience is incredibly useful — and it's also a door. If it's not well secured, whoever finds it can walk in.

Think about how much of YOUR business runs on exactly that kind of thing:
📹 Cameras and alarms you check from your phone
🌡️ Internet-connected thermostats, door locks, building systems
💳 Point-of-sale systems, equipment a vendor services remotely
⚙️ Any connected machinery or system you monitor online

Every one is the small-business version of what got attacked. Same door. Different scale.

🛑 The lesson to burn into memory: being small is NOT camouflage. It's the opposite. It's what put these facilities in the crosshairs. The soft target doesn't get overlooked — it gets CHOSEN.

But here's the empowering flip side, and it's genuinely good news: if attackers win by finding the WEAKEST, then your whole job is simply — don't be the easy one. You don't need a fortress. You just need to not be the soft target with an obvious unlocked door. That's completely achievable:

✅ Find and secure every system that can be reached from the internet — strong unique passwords + a second verification step. Anything that doesn't NEED internet access shouldn't have it.
✅ Kill default passwords on every connected device and camera.
✅ Keep everything updated.
✅ Separate your critical systems from your general network.
✅ Shut off old vendor connections and unused accounts nobody's touched in months.

Full breakdown: https://www.pendergrassconsulting.com/why-hackers-hit-a-tiny-power-plant-and-small-water-systems-and-what-it-means-for-small-business/

Want to find out if your business is a soft target — before someone else does? That's exactly what we check: https://www.pendergrassconsulting.com/contact/

Iran-linked hackers hit a tiny UK power plant and small US water systems by choosing the weakest, not the biggest. Why being small is not real protection here.

08/27/2026

🇺🇸 Big headline this week: US officials announced that a state-sponsored hacking operation linked to China had targeted NASA, the Federal Reserve, the US Senate, the Justice Department, and more. Sounds like a spy movie, right?

But there's a detail buried in this story that matters WAY more to your small business than the headline does — and it has nothing to do with being a government agency.

The attackers didn't run these operations from their own computers. They HIJACKED THOUSANDS of everyday internet-connected devices — ordinary routers and network gear belonging to regular people and businesses — and used them as disposable stepping stones to launch and disguise their attacks.

Read that again. The equipment used to go after NASA may well have included hacked routers sitting in small offices and homes that had absolutely no idea they were involved. 😮

Here's why sophisticated attackers do this: if they attacked straight from their own systems, it'd point right back at them and be easy to block. So instead they take over a big pile of innocent, poorly-secured devices around the world and bounce their attacks through those. To the victim, the attack looks like it's coming from some random business's router — not the real culprit. Those hijacked devices become both a disguise AND a launching pad. And the owners never know — the device keeps working normally while quietly moonlighting in an attack.

👉 This is why "we're too small to be a target" completely misses the point. You don't have to be the target to be a VICTIM. These operations aren't only hunting for valuable data — they're hunting for devices they can USE. And a small business's router is perfect for the job precisely because it's usually less protected than a big company's. It doesn't need to hold anything valuable. It just needs to be reachable and weakly secured.

(And the same weakness that makes your router useful to them as a weapon makes it a doorway into YOUR network too. It cuts both ways.)

The genuinely good news: the devices that get conscripted are almost always the ones left in a weak state. So the same boring basics that protect you from everyday threats also keep your gear from being drafted into extraordinary ones:

🔑 Change the default passwords on EVERYTHING — every router, firewall, camera, network device. The factory passwords are already known to attackers.
🔄 Keep device software (firmware) updated. Years-old firmware is a prime target. Too old to update? Replace it.
🚪 Close off remote access you don't need. Being reachable/manageable from the open internet is exactly what they scan for.
📋 Know what you have. You can't secure the old router in the closet you forgot about.

Oh — and one reassuring note: this was announced as a LAW ENFORCEMENT WIN. The authorities moved in and dismantled the operation's infrastructure. The good guys are on this.

When a story like this breaks, the businesses that can just shrug it off are the ones that took care of the basics. Full breakdown: https://www.pendergrassconsulting.com/china-targeted-nasa-and-the-federal-reserve-using-hijacked-devices-like-yours/

Want to make sure none of YOUR devices are sitting exposed? That's exactly what we check: https://www.pendergrassconsulting.com/contact/

China-linked hackers hit NASA and the Federal Reserve by hijacking thousands of ordinary routers. Why your own devices can be conscripted, and how to stop it.

08/27/2026

‼️ Picture a routine video call. A dozen people on the grid, someone sharing their screen. Now picture one attendee — a name you didn't quite recognize but figured a coworker invited — quietly taking complete control of your computer. Camera on. Files open. Malware installed. And doing it to every other person on the call, one by one, with NO sign on anyone's screen.

No clicking. No downloading. No button pressed. Just... being in the meeting.

That was the real, demonstrated capability of flaws researchers just found in Zoom's ANNOTATION feature — the tool that lets people draw on a shared screen. Zoom is used by a huge share of the business world, including most of the Fortune 100.

✅ Zoom has released fixes. So the first thing to do, right now: UPDATE ZOOM ON EVERY DEVICE. That's the whole fix for this one.

Here's how it worked: when you draw an annotation, your Zoom sends a little message that everyone else's Zoom unpacks and redraws. The flaw was that the receiving software didn't carefully check those incoming messages — so a booby-trapped "annotation" that isn't really a drawing could hijack the receiving computer. And because every Zoom automatically processes whatever it's sent, the victim didn't have to do anything at all.

⚠️ That "nothing required from the victim" part is what makes it so dangerous. Most attacks need you to slip up — click a bad link, open a bad file. Your best defense is usually an alert human. This one removed the human from the equation. No warning, no prompt to decline, no clue you'd been taken over. When there's no mistake for you to avoid, the ONLY defense is having already installed the fix.

🤖 But here's the part that genuinely stopped me, and it's bigger than Zoom. The researchers say they built the working attack in UNDER 24 HOURS, using FEWER THAN 20 PROMPTS to publicly available AI. In their words, doing this used to be "nation-state work" — elite teams, months of effort, budgets governments regulate like weapons. AI collapsed it to an afternoon.

We keep seeing this exact shift — the same thing happened when researchers altered "tamper-proof" DNA files in 45 minutes with AI. The flaws were always there. What's changed is that the effort to find and weaponize them is collapsing. Which means "that's too hard for anyone to bother with" is no longer protection — and the boring basics, like keeping everything updated, matter more than ever.

The good news: THIS time it was responsible researchers, who reported it privately and got a fix out before going public. The system worked.

What to do:
1️⃣ Update Zoom everywhere — including the occasional-use laptop, the conference room system, the personal phone used for work calls
2️⃣ Turn on automatic updates wherever you can — the gap between "flaw goes public" and "criminals try it" is shrinking fast
3️⃣ Apply the same discipline to ALL your software — browser, operating system, everything
4️⃣ Know what you're running, so nothing slips through when an urgent fix lands

Full breakdown: https://www.pendergrassconsulting.com/one-attendee-could-take-over-the-whole-meeting-the-zoom-flaw-and-why-update-now-matters-more-than-ever/

Tired of wondering whether every device is actually patched? That's literally what we do: https://www.pendergrassconsulting.com/contact/

Flaws in Zoom's annotation feature let one attendee take over others' computers with no click needed -- built by AI in a day. Why 'update now' matters more.

08/26/2026

⚠️ A lot of business owners have this quiet confidence about ransomware: "if my files ever get locked, I'll just restore from backup and tell them to pound sand."

Good instinct. It's also EXACTLY the plan a ransomware operation called Gunra is built to destroy.

Because Gunra doesn't just lock your files. It:
1️⃣ Steals a copy of your data first
2️⃣ Hunts down and DESTROYS your backups — then encrypts everything
3️⃣ Threatens to publish your stolen data if you don't pay in a few days

Think about what step 2 does to you. If your backups are intact, ransomware is a bad day — wipe, restore, move on, pay nothing. If your backups are GONE, that same attack is an existential threat, because the only remaining copy of your business's data is the one the criminals are holding hostage. The whole game is moving you from the first situation to the second before you even know they're inside.

It's serious enough that CISA, the FBI, and South Korean authorities put out a joint advisory. And here's the most useful part — the door they walk through is one you can close:

🚪 Gunra gets in mainly by exploiting KNOWN, already-patched flaws in internet-facing firewalls and VPN appliances (Fortinet and Schneider Electric products). Not secret zero-days — publicly documented holes the makers already released fixes for. The attackers just count on you not having installed the update. The very device you bought to protect you becomes the way in when it's out of date.

So what actually beats this? Every part of its playbook has a specific counter:
✅ Patch your internet-facing equipment promptly (closes the door they use). Make it someone's actual job.
✅ Keep at least one backup an intruder CAN'T reach — offline, or in storage that can't be altered or deleted once written. A backup they can delete isn't a backup; it's a second copy waiting to be destroyed. And test that you can actually restore it.
✅ Change default passwords + turn on multi-factor authentication.
✅ Segment your network so a foothold in one spot can't reach everything (including your backups) at once.

Gunra is frightening, but it's not magic. It gets in through a door you can close, and defeats recovery by destroying backups you can put out of its reach. The businesses that fall to it are overwhelmingly the ones that left the known door open and kept their safety net where an intruder could cut it down.

Full breakdown: https://www.pendergrassconsulting.com/the-ransomware-that-hunts-your-backups-what-gunra-teaches-about-real-recovery/

Want to know if your backups would actually survive an attack — and if your firewall's up to date? https://www.pendergrassconsulting.com/contact/

Gunra ransomware steals your data and destroys your backups so you can't recover -- and gets in through unpatched firewalls. The habits that actually defeat it.

08/24/2026

💼 Picture this. You're good at your job and quietly open to something better. A recruiter reaches out — they've clearly read your resume, they know your skills, the role fits perfectly. You have a nice chat. As part of getting set up, they ask you to install a specific app to "connect securely."

You're a competent, technical person. This all seems completely normal. So you install it.

And you just handed an attacker the ability to run commands on your computer.

Ukraine's national cyber agency (CERT-UA) documented exactly this campaign. The targets were experienced IT professionals — and it worked. Because here's the uncomfortable truth: this attack doesn't break your technology. It works on your judgment, your ambition, and your trust.

Watch how every single step feels NORMAL:
🔍 They browse real job sites and read actual resumes to pick targets — so when they contact you, they already know your background and seem instantly credible
📞 They pose as a recruiter from a real-sounding company (even name-dropping a genuine business as the employer), start in the job site's chat, then move to a messaging app — exactly like real recruiting
💻 They ask you to install setup software for the "role" — a mundane request
🎣 THE CLEVER PART: the normal files they give you conveniently DON'T WORK. When you hit that snag, the helpful "recruiter" offers a fix — download this custom app instead. THAT one's the weapon. The failure was engineered so installing the malicious tool feels like a troubleshooting step you figured out yourself.
🐴 The custom app was a REAL, trusted open-source program — quietly modified to run the attacker's commands. Looks legit. Behaves legit. Until it doesn't.

👉 And here's why this matters even if you'll never be targeted by this exact crew. The underlying move — impersonate someone trusted, build rapport, use that trust to get you to install something — is the most common attack there is. The recruiter is just one costume. The same con shows up as:
• "IT support" asking you to install a remote-access tool to "fix your account"
• A "vendor" urging you to install a critical update from their link
• A new "client" needing you to open a document or join a portal
• A recruiter messaging your EMPLOYEES, who don't think of a job offer as a security risk

The costume changes. The con doesn't.

🛑 THE ONE RULE: Be deeply skeptical any time an unsolicited contact — however friendly, professional, or exciting — leads to a request that you install software, download a file, or enter your password. That combination is the fingerprint of the attack, whatever it's wearing. And if the "official" version conveniently fails and a custom replacement appears? That's not a coincidence. That's the trap.

Full breakdown: https://www.pendergrassconsulting.com/the-fake-job-offer-that-installs-malware-why-even-technical-experts-fall-for-it/

The best defense isn't better software — it's a team that knows the script when they hear it: https://www.pendergrassconsulting.com/services/cybersecurity-training/

A fake recruiter tricked IT experts into installing rigged software. The social-engineering pattern that targets every business, and the one rule that stops it.

08/22/2026

🚀 A company that makes components for PATRIOT and THAAD missile-defense systems, fighter jets, satellites, and torpedoes just got breached.

Not by a foreign spy agency. Not by some Hollywood hacking scene.

One employee clicked one link.

That's the whole story — and it should permanently kill the most dangerous idea in small business security: "we're too small to be a target."

We know the details precisely, because the company (IEH Corporation) had to disclose it in an SEC filing. Here's exactly how it went:

1️⃣ An attacker posing as a "prospective business contact" emailed an employee a link dressed up as a normal Microsoft "someone shared a document with you" message.
2️⃣ The employee clicked, landed on a fake login page built to look exactly like the real Microsoft sign-in, and typed in their password.
3️⃣ Those credentials went straight to the attacker, who logged into the real mailbox.
4️⃣ 🚩 Then the telling part: the attacker set up malicious mailbox RULES — automated instructions to quietly forward or hide emails — so they could keep watching after the fact. That's not a snoop. That's someone setting up to STAY.

No malware. No exploited flaw. A convincing email, a fake page, one click, one password — inside the email of a company that arms the US military.

👉 Here's why "just one mailbox" is a genuine disaster. Think about what's in YOUR inbox right now: every client conversation, invoices and banking details, the "reset my password" link for all your OTHER accounts, sensitive attachments — and your identity. An attacker in your email can message your bookkeeper AS YOU, from your REAL account, saying "please update the wire details," and it passes every test because it genuinely came from you. That's business email compromise, and it starts with exactly this kind of access.

So what actually protects you?

✅ Turn on multi-factor authentication — but know its limit. That second code is essential. But modern fake login pages can grab the code too, in real time. MFA is a critical layer, not a force field.
✅ Train the CLICK — it's the whole game. Every layer came after one person trusted one link. The habit to build: NEVER enter your password on a page you reached by clicking an email link. Go to the site directly. That one habit stops this cold.
✅ Learn to check your mailbox rules. A forwarding rule you didn't create is a screaming red flag — and most people don't know the setting exists.

If a missile-defense supplier's inbox can be opened with one link, the question isn't whether your team gets tested the same way. It's whether they're ready.

Full breakdown: https://www.pendergrassconsulting.com/one-click-one-mailbox-how-a-missile-defense-supplier-got-breached-and-why-were-too-small-is-a-myth/

Would your team spot it? Free quiz: https://www.pendergrassconsulting.com/services/cybersecurity-training/

A missile-defense supplier was breached when one employee entered their password on a fake login page. Why 'we're too small to be a target' is a dangerous myth.c

08/21/2026

⚖️ For as long as computer crime has existed, one American rule has been nearly absolute: private companies are NOT allowed to hack back.

If a gang encrypts your files and demands a ransom, you can defend your own systems all you want — but the moment you reach out and touch THEIR computers, even just to get your own stolen data back, you've likely committed a federal crime yourself. The victim who strikes back becomes the lawbreaker. That's been settled for decades.

This week, that rule got its first serious crack.

A national security memo signed August 12 directs the government to build a program that would let VETTED private companies conduct offensive cyber operations against foreign criminal gangs — to break into their systems, spy on them, and even disrupt or destroy their operations — all under government approval and oversight. It's one of the biggest shifts in US cyber policy in years.

We wrote a full, evenhanded breakdown — no cheerleading, no hand-wringing, no partisan take. Just what it actually does and the honest debate around it. Here's the short version of both sides:

✅ THE CASE FOR IT:
• The best cyber talent is in the private sector and has been underused against criminals
• Playing pure defense while Americans lose $20+ BILLION a year to cyber-crime is a losing game
• It could finally deter criminals — make targeting Americans genuinely dangerous instead of easy money
• It's not vigilantism: vetting, government contracts, advance approval, federal oversight

⚠️ THE CASE AGAINST IT:
• Attribution is HARD — criminals hide behind hacked computers of innocent people, so you might hit a hospital or small business by mistake
• Collateral damage and escalation — operations can spill onto shared systems, and criminals (some tied to foreign governments) may strike back at the companies or their employees
• The legal ground is untested in court, and US permission doesn't cover FOREIGN laws — hack a server abroad and you may be a criminal there
• A "perpetual motion machine" for contractors — pay firms to find targets and they've got a reason to keep finding them
• The slippery slope — private companies conducting offensive attacks is a big line to cross

Both sides are arguing in good faith about a genuinely hard problem. Cybercrime against Americans really is enormous and largely beyond law enforcement's reach — AND the risks the critics raise are real. It's a trade-off, not an obvious right answer.

Why it matters to you: the whole stated goal is fewer criminals successfully targeting American small businesses and families. And it's a landmark moment in something we've been tracking — serious cyber capability steadily spreading outward from governments into the wider world.

Full breakdown, both sides laid out fairly: https://www.pendergrassconsulting.com/america-just-cracked-its-ban-on-private-hacking-what-the-new-hack-back-memo-really-means/

A presidential memo lets vetted US firms hack foreign criminal gangs, cracking a decades-old ban. The honest case for and against private hack-back, laid out.

08/21/2026

🚀 Somewhere in a lab, a piece of software sits between human operators and actual spacecraft flying through actual space. It's the steering wheel for hardware worth hundreds of millions of dollars that can never be physically reached again.

You'd assume a system like that — the literal control panel for spacecraft — would be locked behind the most formidable security on Earth.

A researcher just revealed it wasn't.

In NASA's open-source ground-control software, he found flaws that could have let an UNAUTHENTICATED attacker — no password, no account, no credentials at all — issue commands to spacecraft and instruments.

And here's the part that should stop every business owner cold. This wasn't some genius-level, movie-hacker feat. In the researcher's own words, it was "a stack of small, ordinary web mistakes." He was blunt about it: "No step requires a memory-corruption primitive, an auth bypass, or a novel exploit technique. It is four well-understood web weaknesses composed against a very high-value target."

Four ordinary unlocked doors. That happened to line up into a hallway leading to spacecraft.

The four mistakes:
🚪 The console listened to the whole network instead of staying local — an open window where there should've been a wall
🔓 The command functions asked NOBODY for a password
🕸️ There was no protection against a booby-trapped web page quietly sending commands in the background
📂 It ran scripts and handled file paths loosely

That third one is the one you really need to understand, because it means the attacker didn't even necessarily need to reach NASA's network. Your browser is like a trusted assistant carrying your credentials. If you're logged into a system in one tab and open a malicious page in another, that page can whisper commands to the first system through your browser — and if the system isn't protected, it may just... do them. The attacker never touches the target directly. They just need you to open the wrong link.

👉 Now here's why this NASA story is really a story about YOUR business. Look at how much you run through the exact same kind of technology — a web server, an admin login, buttons that make things happen:
• Your website's admin dashboard
• Your point-of-sale or booking console
• Your router, cameras, and network storage web pages
• Any internal tool or portal you log into

Every one is fundamentally the same kind of system as that NASA console. And every one is vulnerable to the same family of ordinary mistakes. The NASA headline is dramatic because the stakes were spacecraft. But the MISTAKES were completely ordinary — which means they're the same ones that can hide in the humbler web tools running your business.

The good news: NASA already fixed it, and no real spacecraft was ever commanded — a researcher found it and reported it responsibly. That's the system working. The lesson for the rest of us is simple: the ordinary mistakes are the ones that get you, and the only reliable way to find them is to look before someone else does.

Full breakdown, in plain English: https://www.pendergrassconsulting.com/attackers-could-command-spacecraft-through-nasa-software-and-the-mistakes-were-utterly-ordinary/

Want someone to look at your web tools the way this researcher looked at NASA's? That's exactly what we do: https://www.pendergrassconsulting.com/contact/

A researcher could command NASA spacecraft through four ordinary web mistakes -- the same errors hiding in ordinary business web tools. What it means for you.