Infrastructure Cyberattacks, AI-Powered Threats Pummel Africa
Convincing phishing emails, synthetic identities, and deepfakes all have been spotted in cyberattacks on the continent.
Cloud Apps Make the Case for Pentesting-as-a-Service
Applications are increasingly distributed, expanding companies' cloud attack surfaces, and requiring regular testing to find and fix vulnerabilities — else companies risk a growing sprawl of services.
https://www.darkreading.com/application-security/pentesting-as-a-service-cloud-applications
Microsoft Zero Day Used by Lazarus in Rootkit Attack
North Korean state actors Lazarus Group used a Windows AppLocker zero day, along with a new and improved rootkit, in a recent cyberattack, researchers report.
FBI, CISA Release IoCs for Phobos Ransomware
Threat actors using the malware have infected systems within government, healthcare, and other critical infrastructure organizations since at least 2019.
https://www.darkreading.com/cyberattacks-data-breaches/fbi-cisa-release-iocs-for-phobos-ransomware
Chinese APT Developing Exploits to Defeat Already Patched Ivanti Users
More bad news for Ivanti customers: soon, even if you've patched, you still might not be safe from relentless attacks from high-level Chinese threat actors.
https://www.darkreading.com/endpoint-security/chinese-apt-exploits-defeat-patched-ivanti-users
Biden Administration Unveils Data Privacy Executive Order
The presidential move orders a variety of different departments and organizations to regulate personal data better and provide clear, high standards to prevent foreign access.
https://www.darkreading.com/cyber-risk/biden-administration-unveils-data-privacy-executive-order
Tenable Introduces Visibility Across IT, OT, and IoT Domains
Troutman Pepper Forms Incidents and Investigations Team
Cybersecurity Startup Morphisec Appoints Ron Reinfeld As CEO
Entro Extends Machine Secrets and Identities Protection With Machine Identity Lifecycle Management
MITRE Rolls Out 4 Brand-New CWEs for Microprocessor Security Bugs
Goal is to give chip designers and security practitioners in the semiconductor space a better understanding of major microprocessor flaws like Meltdown and Spectre.
Hugging Face AI Platform Riddled With 100 Malicious Code-Execution Models
The finding underscores the growing risk of weaponizing publicly available AI models and the need for better security to combat the looming threat.
MTTR: The Most Important Security Metric
Measuring and tracking your mean time to remediate shows whether vulnerability management is reducing risk and closing opportunities for adversaries.
https://www.darkreading.com/cyberattacks-data-breaches/mttr-most-important-security-metric
Ransomware-as-a-Service Spawns Wave of Cyberattacks in Middle East & Africa
Experts advise organizations in the region to refuse to pay ransom demands.
Echoes of SolarWinds in New 'Silver SAML' Attack Technique
A successor to the "Golden SAML" tactic used in the SolarWinds campaign, this new technique taps SAML response forgery to gain illegitimate access to apps and services.
US Government Expands Role in Software Security
The White House Office of the National Cyber Director puts software developers on notice, calling for a move to memory-safe programming languages and the development of security metrics.
Meet 'XHelper,' the All-in-One Android App for Global Money Laundering
User-friendly apps allow anybody to serve as traffickers for cybercrime syndicates.
'Voltzite' Zaps African Utilities as Part of Volt Typhoon's Onslaught
The China-backed APT that's been trying to set itself up inside US critical infrastructure for the purpose of disrupting physical processes is deploying a similar playbook in Africa.
Cyberattackers Lure EU Diplomats With Wine-Tasting Offers
A targeted attack aiming to exploit geopolitical relations between India and Europe delivers previously undocumented, uniquely evasive backdoor malware.
Converging State Privacy Laws and the Emerging AI Challenge
It's time for companies to look at what they're processing, what types of risk they have, and how they plan to mitigate that risk.
https://www.darkreading.com/cyber-risk/converging-state-privacy-laws-emerging-ai-challenge