Dark Reading Daily -- June 23, 2023

Azure AD 'Log in With Microsoft' Authentication Bypass Affects Thousands

The "nOAuth" attack allows cross-platform spoofing and full account takeovers, and enterprises need to remediate the issue immediately, researchers warn.

LockBit Developing Ransomware for Apple M1 Chips, Embedded Systems

Under construction: The world's leading ransomware gang is workshopping ransomware for less obvious systems beyond Windows environments. Experts weigh in on how worried we should be.

USB Drives Spread Spyware as China's Mustang Panda APT Goes Global

Camaro Dragon (Mustang Panda) is spreading a malware variant of WispRider quickly across the globe even through air gaps, often unbeknownst to users.

Even With No Recession, Smaller Firms Aim to Consolidate Security Tools

Small and midsized companies work to jettison some security tools to simplify operations and reduce cost, even as any economic downturn continues to remain at bay.

IT Staff Increasingly Saddled With Data Protection Compliance

Compliance, seen as a burden for businesses, is being passed to overloaded IT departments — leaving organizations unsure if they're compliant at all.

5 Steps for Minimizing Dark Data Risk

Dark data may be your most elusive asset, but it can also be your most costly if you don't protect it.

Lessons From a Pen Tester: 3 Steps to Stay Safer

From hardening Windows systems to adding access control and segmenting the network, there are steps organizations can take to better secure corporate data.

Patch Now: Cisco AnyConnect Bug Exploit Released in the Wild

A ready-made, low-complexity path to pwning the popular enterprise VPN clients for remote workers is now circulating in the wild.

CISA, FBI Offer $10M for Cl0p Ransomware Gang Information

The announcement was posted on Twitter via the Rewards for Justice Twitter account, alongside encrypted messaging system options for anyone to get into contact should they have viable information.

2 More Apple Zero-Days Exploited in Ongoing iOS Spy Campaign

The zero-day security bugs are being used to deploy the sophisticated but "odd" TriangleDB spying implant on targeted iOS devices.

Rorschach Ransomware: What You Need to Know

Learn how the latest ransomware variant has heightened attack execution speed and what that means for cybersecurity operations.

Placing People & Realism at the Center of Your Cybersecurity Strategy

While it's impossible for an organization to be completely secure, there's no reason to be defenseless.

Emerging Ransomware Group 8Base Doxxes SMBs Globally

A threat you've never heard of is using double extortion attacks on mom-and-pop shops around the globe.

LATEST FROM DR TECHNOLOGY

Growing SaaS Usage Means Larger Attack Surface

Software-as-a-service has its benefits, but abandoned SaaS integrations and idle data sharing introduce risk to the enterprise.

LATEST FROM THE EDGE

Job Seekers, Look Out for Job Scams

Scammers are setting out lures for people looking for work. If a position sounds too good to be true, it probably is.

LATEST FROM DR GLOBAL

South African Female Students Offered Cyber Scholarship

Women of color are being offered a scholarship opportunity in South Africa — the offer will cover costs for pursuing a cyber career and encourage greater diversity of those studying cybersecurity courses.

How to Use Threat Intelligence to Mitigate Third-Party Risk