Dark Reading Daily -- June 29, 2022

China-Backed APT Pwns Building-Automation Systems with ProxyLogon

The previously unknown state-sponsored group is compromising industrial targets with the ShadowPad malware before burrowing deeper into networks.

Facebook Business Pages Targeted via Chatbot in Data-Harvesting Campaign

The clever, interactive phishing campaign is a sign of increasingly complex social-engineering attacks, researchers warn.

Ransomware Volume Nearly Doubles 2021 Totals in a Single Quarter

Like a hydra, every time one ransomware gang drops out (REvil or Conti), plenty more step up to fill the void (Black Basta).

'Raccoon Stealer' Scurries Back on the Scene After Hiatus

Researchers this week said they had observed criminals using a new and improved version of the prolific malware, barely three months after its authors announced they were quitting.

Google Analytics Continues to Lose SEO Visibility as Bans Continue

Google Analytics has been found to be in violation of GDPR privacy laws by Italy — the third country to ban it.

Atlassian Confluence Exploits Peak at 100K Daily

Swarms of breach attempts against the Atlassian Confluence vulnerability are likely to continue for years, researchers say, averaging 20,000 attempts daily as of this week.

A WAF Is Not a Free Lunch: Teaching the Shift-Left Security Mindset

Developers need to think like WAF operators for security. Start with secure coding and think of Web application firewalls not as a prophylactic but as part of the secure coding test process.

How to Find New Attack Primitives in Microsoft Azure

Abuse primitives have a longer shelf life than bugs and zero-days and are cheaper to maintain. They're also much harder for defenders to detect and block.

New Vulnerability Database Catalogs Cloud Security Issues

Researchers have created a new community website for reporting and tracking security issues in cloud platforms and services — plus fixes for them where available.

LockBit 3.0 Debuts With Ransomware Bug Bounty Program

LockBit 3.0 promises to 'Make Ransomware Great Again!' with a side of cybercrime crowdsourcing.

Name That Toon: Cuter Than a June Bug

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Are You Hiring Enough Entry-Level Security Pros?

New (ISC)² survey shows employment levels for entry-level cyber pros lag behind every other experience level.

LATEST FROM THE EDGE

What We Mean When We Talk About Cyber Insurance

Cyber insurance is more than a policy for paying off ransomware gangs. It's designed to be something you transfer risk to when security controls fail.

LATEST FROM DR TECHNOLOGY

Can Zero-Knowledge Cryptography Solve Our Password Problems?

Creating temporary keys that are not stored in central repositories and time out automatically could improve security for even small businesses.

Improving Enterprise Cybersecurity With XDR