Dark Reading Daily -- July 01, 2022

18 Zero-Days Exploited So Far in 2022

It didn't have to be this way: So far 2022's tranche of zero-days shows too many variants of previously patched security bugs, according Google Project Zero.

Google: Hack-for-Hire Groups Present a Potent Threat

Cyber mercenaries in countries like India, Russia, and the UAE are carrying out data theft and hacking missions for a wide range of clients across regions, a couple of new reports said.

API Security Losses Total Billions, But It's Complicated

A recent analysis of breaches involving application programming interfaces (APIs) arrives at some eye-popping damage figures, but which companies are most affected, and in what ways?

Critical ManageEngine ADAudit Plus Vulnerability Allows Network Takeover, Mass Data Exfiltration

An unauthenticated remote code execution vulnerability found in Zoho’s compliance tool could leave organizations exposed to an information disclosure catastrophe, new analysis shows.

Exchange Servers Backdoored Globally by SessionManager

Malicious ISS module exploitation is the latest trend among threat actors targeting Exchange servers, analysts say.

Zero-Days Aren't Going Away Anytime Soon & What Leaders Need to Know

There were a record number of zero-day attacks last year, but some basic cyber-hygiene strategies can help keep your organization more safe.

Patch Now: Linux Container-Escape Flaw in Azure Service Fabric

Microsoft is urging organizations that don't have automatic updates enabled to update to the latest version of Linux Server Fabric to thwart the "FabricScape" cloud bug.

ZuoRAT Hijacks SOHO Routers From Cisco, Netgear

The malware has been in circulation since 2020, with sophisticated, advanced malicious actors taking advantage of the vulnerabilities in SOHO routers as the work-from-home population expands rapidly.

How to Master the Kill Chain Before Your Attackers Do

In the always-changing world of cyberattacks, preparedness is key.

Facebook Business Pages Targeted via Chatbot in Data-Harvesting Campaign

The clever, interactive phishing campaign is a sign of increasingly complex social-engineering attacks, researchers warn.

LATEST FROM THE EDGE

A Fintech Horror Story: How One Company Prioritizes Cybersecurity

A password link that didn't expire leads to the discovery of exposed personal information at a payments service.

LATEST FROM DR TECHNOLOGY

NIST Finalizes macOS Security Guidance

NIST SP800-219 introduces the macOS Security Compliance Project (mSCP) to assist organizations with creating security baselines and defining controls to protect macOS endpoints.

Improving Enterprise Cybersecurity With XDR