Dark Reading Daily -- April 21, 2023

3CX Supply Chain Attack Tied to Financial Trading App Breach

Mandiant found that North Korea's UNC4736 gained initial access on 3CX's network when an employee downloaded a weaponized but legitimately-signed app from Trading Technologies.

'GhostToken' Opens Google Accounts to Permanent Infection

A bug in how Google Cloud Platform handles OAuth tokens opened the door to Trojan apps that could access anything in users' personal or business Google Drives, Photos, Gmail, and more.

'AuKill' Malware Hunts & Kills EDR Processes

Attackers are using custom malware to exploit drivers and terminate security processes so they can deploy ransomware.

Global Spyware Attacks Spotted Against Both New & Old iPhones

Campaigns that wielded NSO Group's Pegasus against high-risk users over a six-month period demonstrate the growing sophistication and relentless nature of spyware actors.

GPT-4 Provides Improved Answers While Posing New Questions

As is typical with emerging technologies, both innovators and regulators struggle with developments in generative AI, much less the rules that should govern its use.

Expert Insight: Dangers of Using Large Language Models Before They Are Baked

Today's LLMs pose too many trust and security risks.

Twitter's 2FA Policy Is a Call for Passkey Disruption

Overcoming the limitations of consumer MFA with a new flavor of passwordless.

Major US CFPB Data Breach Caused by Employee

The sensitivity of the personal information involved in the breach has yet to be determined by agency officials, but it affects 256,000 consumers.

Trigona Ransomware Trolling for 'Poorly Managed' MS-SQL Servers

Vulnerable MS-SQL database servers have external connections and weak account credentials, researchers warn.

Russian Fancy Bear APT Exploited Unpatched Cisco Routers to Hack US, EU Gov't Agencies

The nation-stage threat group deployed custom malware on archaic versions of Cisco's router operating system. Experts warn that such attacks targeting network infrastructure are on the rise.

How to Prevent 2 Common Attacks on MFA

MFA isn't immune from the tug of war between attackers and defenders.

Killnet Boss Exposes Rival Leader in Kremlin Hacktivist Beef

Killnet's leader outs the identity of the new Anonymous Russia leader, in an effort to consolidate power among pro-Russia cybercriminals.

LATEST FROM THE EDGE

New Policy Group Wants to Improve Cybersecurity Disclosure, Support Researchers

The new Security Legal Research Fund and the Hacking Policy Council are aimed at protecting "good faith" security researchers from legal threats and giving them a voice in policy discussions.

LATEST FROM DR TECHNOLOGY

OpenSSF Adds Software Supply Chain Tracks to SLSA Framework

The Open Source Security Foundation's SLSA v1.0 release is an important milestone in improving software supply chain security and providing organizations with the tools they need to protect their software.

Successfully Managing Identity in Modern Cloud and Hybrid Environments