Dark Reading Daily -- January 20, 2023

Attackers Crafted Custom Malware for Fortinet Zero-Day

The "BoldMove" backdoor demonstrates a high level of knowledge of FortiOS, according to Mandiant researchers, who said the attacker appears to be based out of China.

EmojiDeploy Attack Chain Targets Misconfigured Azure Service

Multiple misconfigurations in a service that underpins many Azure features could have allowed an attacker to remotely compromise a cloud user's system.

PayPal Breach Exposed PII of Nearly 35K Accounts

The credential-stuffing attack, likely fueled by password reuse, yielded personal identifiable information that can be used to verify the authenticity of previously stolen data.

Cybercriminals Target Telecom Provider Networks

The growing use of mobile devices for MFA and the proliferation of 5G and VoIP in general could result in more attacks in future, experts say.

Ethically Exploiting Vulnerabilities: A Play-by-Play

There's a fine line between a hacker and an attacker, but it pays to be proactive. Consider tests by ethical hackers, a red team, or pen testers, and then bolster your company's defenses against malicious attacks.

Massive Adware Campaign Shuttered

Mainly Apple iOS in-app ads were targeted, injecting malicious JavaScript code to rack up phony views.

Name That Toon: Poker Hand

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Vulnerable Historian Servers Imperil OT Networks

These specialized database servers, which collect and archive information on device operation, often connect IT and OT networks.

ChatGPT Opens New Opportunities for Cybercriminals: 5 Ways for Organizations to Get Ready

From updating employee education and implementing stronger authentication protocols to monitoring corporate accounts and adopting a zero-trust model, companies can better prepare defenses against chatbot-augmented attacks.

Cybersecurity and the Myth of Quiet Quitting

People are working harder than ever, but they're not happy about it — and the insider threat is all too real.

ICS Confronted by Attackers Armed With New Motives, Tactics, and Malware

Threat actors are diversifying across all aspects to attack critical infrastructure, muddying the threat landscape, and forcing industrial organizations to rethink their security.

LATEST FROM THE EDGE

3 Lessons Learned in Vulnerability Management

In 2022, multiple high-profile vulnerabilities like Log4j and OpenSSL provided important takeaways for future public reporting.

LATEST FROM DR TECHNOLOGY

Software Supply Chain Security Needs a Bigger Picture

SBOMs aren't enough. OpenSSF's Alpha-Omega brings in new blood to help secure the open source projects most impactful to the software supply chain.

The Promise and Reality of Cloud Security