Dark Reading Daily -- September 30, 2022

Dangerous New Attack Technique Compromising VMware ESXi Hypervisors

China-based threat actor used poisoned vSphere Installation Bundles to deliver multiple backdoors on systems, security vendor says.

The Country Where You Live Impacts Password Choices

Literacy, levels of personal freedom, and other macro-social factors help determine how strong average passwords are in a given locale, researchers have found.

Espionage Group Wields Steganographic Backdoor Against Govs, Stock Exchange

APT group Witchetty (aka LookingFrog) has exploited the ProxyShell and ProxyLogon vulnerabilities to gain initial access and deploy new custom cyber tools against government agencies and a stock exchange.

Why the US Should Help Secure Mexican Infrastructure — and What It Gets in Return

Call it cross-border enlightened self-interest: As one of the US's premier trade partners and closest neighbors, what's bad for Mexico is bad for the US.

What Lurks in the Shadows of Cloud Security?

Organizations looking to get ahead in cloud security have gone down the path of deploying CSPM tooling with good results. Still, there’s a clear picture that data security and security operations are next key areas of interest.

Capital One Phish Showcases Growing Bank-Brand Targeting Trend

Capital One lures leveraged the bank's new partnership with Authentify, showing that phishers watch the headlines, and take advantage.

XSS Flaw in Prevalent Media Imaging Tool Exposes Trove of Patient Data

Bugs in Canon Medical's Virea View could allow cyberattackers to access several sources of sensitive patient data.

Most Attackers Need Less Than 10 Hours to Find Weaknesses

Vulnerable configurations, software flaws, and exposed Web services allow hackers to find exploitable weaknesses in companies' perimeters in just hours, not days.

Time to Change Our Flawed Approach to Security Awareness

Defend against phishing attacks with more than user training. Measure users' suspicion levels along with cognitive and behavioral factors, then build a risk index and use the information to better protect those who are most vulnerable.

Sophisticated Covert Cyberattack Campaign Targets Military Contractors

Malware used in the STEEP#MAVERICK campaign features rarely seen obfuscation, anti-analysis, and evasion capabilities.

LATEST FROM THE EDGE

3 Reasons Why BEC Scams Work in Real Estate

Identity verification could be the key to fighting back and building trust in an industry beset with high-stakes fraud.

LATEST FROM DR TECHNOLOGY

Intel Hardens Confidential Computing With Project Amber Updates

The chip giant has developed new features and services to make it more difficult for malicious hackers and insiders to access sensitive data from applications in the cloud.

How Machine Learning, AI & Deep Learning Improve Cybersecurity