Dark Reading Daily -- May 06, 2022

Docker Under Siege: Cybercriminals Compromise Honeypots to Ramp Up Attacks

Cloud containers are increasingly part of the cybercrime playbook, with researchers flagging ongoing scanning for Docker weaknesses along with rapid exploitation to infect systems with coin-miners, denial-of-service tools, and ransomware.

Heroku: Cyberattacker Used Stolen OAuth Tokens to Steal Customer Account Credentials

The same attack that allowed a threat actor to steal data from private Heroku GitHub repositories also resulted in the compromise of customer credentials, the company now says.

Critical Cisco VM-Escape Bug Threatens Host Takeover

The vendor also disclosed two other security vulnerabilities that would allow remote, unauthenticated attackers to inject commands as root and snoop on sensitive user information.

1,000+ Attacks in 2 Years: How the SideWinder APT Sheds Its Skin

Researcher to reveal fresh details at Black Hat Asia on a tenacious cyber-espionage group attacking specific military, law enforcement, aviation, and other entities in Central and South Asia.

Why Security Matters Even More in Online Gaming

As the gaming sector booms, game publishers and gaming networks have been heavily targeted with distributed denial-of-service (DDoS) attacks in the last year.

NIST Issues Guidance for Addressing Software Supply-Chain Risk

Amid ongoing software supply-chain jitters, the US' top tech division is offering a finalized, comprehensive cybersecurity control framework for managing risk.

FBI: Bank Losses From BEC Attacks Top $43B

Law enforcement attributes a recent 65% spike in BEC attack losses to COVID-19 restrictions and the ongoing reality of a remote workforce.

A Third of Americans Use Easy-to-Guess Pet Passwords

Far too many turn to Jingles, Mittens, or Bella for password inspiration, given that these are some of the easiest passwords to crack.

What Star Wars Teaches Us About Threats

The venerable film franchise shows us how to take threats in STRIDE.

Security Stuff Happens: What Will the Public Hear When You Say You've Been Breached?

A company's response to a breach is more important than almost anything else. But what constitutes a "good" response following a security incident? (Part 2 of a series.)

How to Create a Cybersecurity Mentorship Program

As the talent shortage rages on, companies have found mentorship programs to be one of the best ways to obtain the security skills they need to develop their existing teams.

EDITORS' CHOICE

China-Backed Winnti APT Siphons Reams of US Trade Secrets in Sprawling Cyber-Espionage Attack

Operation CuckooBees uncovered the state-sponsored group's sophisticated new tactics in a years-long campaign that hit more than 30 tech and manufacturing companies.

LATEST FROM THE EDGE

Name That Edge Toon: Flower Power

Come up with a clever caption, and our panel of experts will reward the winner with a $25 Amazon gift card.

LATEST FROM DR TECHNOLOGY

Microsoft, Apple, and Google Promise to Expand Passwordless Features

The passwordless future just became closer to reality, as Microsoft, Apple, and Google pledged to make passwordless possible across operating systems and browsers.

Practical Network Security Approaches for a Multicloud, Hybrid IT World