Dark Reading Weekly -- April 13, 2023

Lazarus Group's 'DeathNote' Cluster Pivots to Defense Sector

Usually focused on going after cryptocurrency organizations, the threat actor has begun targeting defense companies around the world.

Microsoft: NSO Group-Like 'QuaDream' Actor Selling Mobile Spyware to Governments

Researchers at Microsoft have discovered links between a threat group tracked as DEV-0196 and an Israeli private-sector company, QuaDream, that sells a platform for exfiltrating data from mobile devices.

Microsoft Patches 97 CVEs, Including Zero-Day & Wormable Bugs

The April 2023 Patch Tuesday security update also included a reissue of a fix for a 10-year-old bug that a threat actor recently exploited in the supply chain attack on 3CX.

1M+ WordPress Sites Hacked via Zero-Day Plug-in Bugs

A wide-ranging campaign to inject malicious code into WordPress-run websites has been ongoing for at least five years.

Pair of Apple Zero-Days Under Active Exploit; Patch & Update Accordingly

Unpatched Macs, iPhones, and iPads open to browser takeover and system kernel-level malicious code execution, Apple warns.

Cybercriminals 'CAN' Steal Your Car, Using Novel IoT Hack

Your family's SUV could be gone in the night thanks to a headlight crack and hack attack.

Samsung Engineers Feed Sensitive Data to ChatGPT, Sparking Workplace AI Warnings

In three separate incidents, engineers at the Korean electronics giant reportedly shared sensitive corporate data with the AI-powered chatbot.

Russia's Joker DPR Claims Access to Ukraine Troop Movement Data

A hacktivist group working with Russia claims it breached DELTA, the Ukrainian battlefield management system (BMS).

'BEC 3.0' Is Here With Tax-Season QuickBooks Cyberattacks

In next-gen, credential-harvesting attacks, phishing emails use cloud services and are free from the typical bad grammar or typos they've traditionally used (and which users have learned to spot).

Rethinking Cybersecurity's Structure & the Role of the Modern CISO

A CISO with a focused role will be better prepared to thrive in an organization and accelerate adoption and understanding of cybersecurity.

How Password Managers Can Get Hacked

Password managers aren't foolproof, but they do help mitigate risks from weak credentials and password reuse. Following best practices can contribute to a company's defenses.

LastPass Breach Reveals Important Lessons

Devastating cyberattacks often can be prevented with basic cybersecurity measures.

Bad Actors Will Use Large Language Models — but Defenders Can, Too

Security teams need to find the best, most effective uses of large language models for defensive purposes.

Shoring Up the Software Supply Chain Across Enterprise Applications