Dark Reading Daily -- August 04, 2023

Exclusive: CISA Sounds the Alarm on UEFI Security

Had Microsoft had adopted a more secure update path to mitigate the BlackLotus UEFI bootkit, it might already be eliminated, a CISA official says.

World Cup Glory Looms, and So Do Cyber Threats, Microsoft Warns

The attack surface of a live event like this summer’s World Cup in Australia and New Zealand rivals that of a large multinational enterprise, or even a small city.

Piles of Unpatched IoT, OT Devices Attract ICS Cyberattacks

Industrial devices are less likely to be patched due to expensive downtime, and threat actors have taken notice.

Cult of the Dead Cow Hacktivists Give Life to 'Privacy-First' App Framework

The well-known collective is taking on targeted advertising with the Veilid framework and says it wants to make the Internet accessible to everyone who fears being monetized.

Russia's 'Midnight Blizzard' Hackers Launch Flurry of Microsoft Teams Attacks

The Nobelium APT is launching highly targeted Teams-based phishing attacks on government and industrial targets using compromised Microsoft 365 tenants, with the aim of data theft and cyber espionage.

As Artificial Intelligence Accelerates, Cybercrime Innovates

Rare government, industry alignment on AI threats means we have an opportunity to make rapid strides to improve cybersecurity and slip the hold cybercriminals have on us.

How to Create an Effective GRC Program: 3 Phases

A crawl, walk, run approach allows organizations to establish a governance, risk, and compliance (GRC) program that grows and matures with the business.

(Sponsored Article) Insider Risk Management Starts With SaaS Security

SaaS security posture management helps mitigate common threats posed by malicious or negligent insiders.

Iran's APT34 Hits UAE With Supply Chain Attack

The prolific APT, also known as OilRig, was caught targeting an IT company's government clients in the region, with the aim of carrying out cyber espionage.

Russian APT 'BlueCharlie' Swaps Infrastructure to Evade Detection

Despite being outed earlier this year, the advanced persistent threat group is trying to sneak past researchers again.

Cyber-Insurance Underwriting Is Still Stuck in the Dark Ages

Innovations in continuous controls monitoring may be the only way underwriters can offer cyber-insurance policies that make sense in the market.

Utilities Face Security Challenges as They Embrace Data in New Ways

A culture of cybersecurity and implementing industry best practices can go a long way toward protecting a utility.

Tesla Jailbreak Unlocks Theft of In-Car Paid Features

Want heated seats for free? Self-driving in Europe despite a regulatory ban? Researchers have discovered the road to free car-modding on the popular Tesla EVs.

LATEST FROM THE EDGE

Protecting Intellectual Property When It Needs to Be Shared

Companies should use a variety of tools and strategies, both technical and policy, to protect their IP from third-party risk.

LATEST FROM DR TECHNOLOGY

10 Free Purple Team Security Tools to Check Out

Check out this curated list of cool tools and platforms for both offensive security experts and defenders, all of which will be released or demoed at Black Hat USA 2023.

LATEST FROM DR GLOBAL

Hacktivist Group 'Mysterious Team Bangladesh' Goes on DDoS Rampage

The emerging threat has carried out 750 DDoS attacks and 78 website defacements in just one year to support its religious and political motives.

How Supply Chain Attacks Work, and How to Stop Them