Dark Reading Daily -- May 12, 2023

Dragos Employee Hacked, Revealing Ransomware, Extortion Scheme

Attackers compromised the personal email of a new employee and, when the initial attack failed, attempted through socially engineered messages to get the company to pay them off.

Plug-and-Play Microsoft 365 Phishing Tool 'Democratizes' Attack Campaigns

New "Greatness" phishing-as-a-service used in attacks targeting manufacturing, healthcare, technology, and other sectors.

CISA Addresses 'Cyber Poor' Small Biz, Local Government

Relatively few organizations have the resources for security programs and security professionals, so the US cyber agency is putting programs in place to help them, while striving to understand the scope of the problem itself.

Multiple Ransomware Groups Adapt Babuk Code to Target ESXi VMs

Two years ago, a popular ransomware-as-a-service group's source code got leaked. Now other ransomware groups are using it for their own purposes.

Billy Corgan Paid Off Hacker Who Threatened to Leak New Smashing Pumpkins Songs

Corgan got FBI involved to track down the cybercriminal, who had stolen from other artists as well, he said.

North Korean Hackers Behind Hospital Data Breach in Seoul

Data on more than 830K people exposed in the 2021 cyberattack.

Startup Competition Secures ML Systems, Vulnerabilities in Automation

RSA's Innovation Sandbox 2023 focused on the software supply chain, as well as attack surfaces exposed by generative AI, ML systems, and APIs.

Why Economic Downturns Put Innovation at Risk & Threaten Cyber Safety

Supplementing staff by hiring hackers to seek holes in a company's defense makes economic sense in a downturn. Could they be cybersecurity's unlikely heroes in a recession?

Leak of Intel Boot Guard Keys Could Have Security Repercussions for Years

While Intel is still investigating the incident, the security industry is bracing itself for years of potential firmware insecurity if the keys indeed were exposed.

The Industrywide Consequences of Making Security Products Inaccessible

Accessibility won't solve all of the industry's problems, but it can help tackle a few.

The Problem of Old Vulnerabilities — and What to Do About It

The vulnerabilities most often exploited by ransomware attackers are already known to us.

Microsoft Fixes Failed Patch for Exploited Outlook Vulnerability

Adding a single character to a function in the previous Outlook patch rendered that fix useless, researchers say.

LATEST FROM DR GLOBAL

Dark Reading Goes Global

While the goal of the site's new DR Global section is to expand international coverage, the initial focus will be cybersecurity professionals in the Middle East and Africa.

LATEST FROM THE EDGE

How Boards Can Set Enforceable Cyber Risk Tolerance Levels

Boards love to say they have low risk tolerance, but are they willing to make the expensive and painful decisions to make it truly happen?

LATEST FROM DR TECHNOLOGY

Integrating Cyber Resiliency With FPGAs

Field programmable gate arrays are particularly useful for organizations that are embracing new edge computing devices and applications.

How Enterprises Are Managing Application Security Risks in a Heightened Threat Environment