Dark Reading Daily -- May 31, 2022

ChromeLoader Malware Hijacks Browsers With ISO Files

The malware's abuse of PowerShell makes it more dangerous, allowing for more advanced attacks such as ransomware, fileless malware, and malicious code memory injections.

Critical OAS Bugs Open Industrial Systems to Takeover

The most serious flaw gives attackers a way to remotely execute code on systems that many organizations use to move data in critical ICS environments, security vendor says.

New Chaos Malware Variant Ditches Wiper for Encryption

The Chaos ransomware-builder was known for creating destructor malware that overwrote files and made them unrecoverable -- but the new Yashma version finally generates binaries that can encrypt files of all sizes.

Physical Security Teams' Impact Is Far-Reaching

Here's how physical security teams can integrate with the business to identify better solutions to security problems.

6 Steps to Ensure Cyber Resilience

To minimize the impact of cyber incidents, organizations must be pragmatic and develop a strategy of resilience for dealing with break-ins, advanced malware, and data theft.

(Sponsored Article) Is Your Data Security Living on the Edge?

Gartner's security service edge fundamentally changes how companies should be delivering data protection in a cloud and mobile first world.

Scammer Behind $568M International Cybercrime Syndicate Gets 4 Years

The 14th defendant behind The Infraud Organization contraband marketplace has been sentenced, this time for one count of racketeering.

Zero-Click Zoom Bug Allows Code Execution Just by Sending a Message

Google has disclosed a nasty set of six bugs affecting Zoom chat that can be chained together for MitM and RCE attacks, no user interaction required.

The FDA's New Cybersecurity Guidance for Medical Devices Reminds Us That Safety & Security Go Hand in Hand

The new draft guidance on premarket submissions incorporates quality system regulations and doubles down on a life-cycle approach to product security.

Act Now: Leveraging PCI Compliance to Improve Security

Let the threat landscape guide your company's timeline for complying with new data security standards for credit cards. Use the phase-in time to improve security overall — security as a process — not just comply with new standards.

EDITORS' CHOICE

VMware, Airline Targeted as Ransomware Chaos Reigns

Global ransomware incidents target everything from enterprise servers to grounding an airline, with one India-based group even taking a Robin Hood approach to extortion with the "GoodWill" strain.

LATEST FROM THE EDGE

Most Common Threats in DBIR

Supply chain and ransomware attacks increased dramatically in 2021, which explains why so many data breaches in Verizon's "2022 Data Breach Investigations Report" were grouped as system intrusion.

LATEST FROM DR TECHNOLOGY

Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks

Organizations must ensure their kubelets and related APIs aren’t inadvertently exposed or lack proper access control, offering an easy access point for malicious actors.

Incorporating a Prevention Mindset into Threat Detection and Response