Dark Reading Daily -- April 14, 2023

Majority of US IT Pros Told to Keep Quiet About Data Breaches

To report or not report? While more than half of all companies have suffered a data breach, 71% of IT professionals say they have been told to not report an incident, which could mean legal jeopardy.

New Mirai Variant Employs Uncommon Tactics to Distribute Malware

RapperBot's initial infection tactic is one example of the different methods attackers are using to distribute malware.

Remcos RAT Targets Tax Pros to Scurry Off With Workers' Filing Info

Something exciting to liven up tax season: cybercriminals accessing sensitive personal information for individuals through the army of accountants preparing for Tax Day in the US.

Legion Malware Marches onto Web Servers to Steal Credentials, Spam Mobile Users

A novel credential harvester compromises SMTP services to steal data from a range of hosted services and providers, and can also launch SMS-based spam attacks against devices using US mobile carriers.

How to Define Tier-Zero Assets in Active Directory Security

There are plenty of AD objects and groups that should be considered tier zero in every environment, but some will vary among organizations.

The Internet Reform Trilemma

An "open" Internet faces challenges from autocratic governance models. Policymakers should instead think about creating an Internet that's equitable, inclusive, and secure.

Money Ransomware Group Enters Double-Extortion Fray

Ransomware group uses API calls to spread throughout shared network resources, researchers say.

Super-Yacht Specialist Lürssen in Dry Dock After Ransomware Attack

The ransomware attack proves that even the wealthiest cannot buy their immunity from threat actors.

LastPass Breach Reveals Important Lessons

Devastating cyberattacks often can be prevented with basic cybersecurity measures.

7 Things Your Ransomware Response Playbook Is Likely Missing

Incident response experts share their secrets for success when it comes to creating a professional-grade ransomware response playbook. Are you ready for the worst?

Microsoft Patches 97 CVEs, Including Zero-Day & Wormable Bugs

The April 2023 Patch Tuesday security update also included a reissue of a fix for a 10-year-old bug that a threat actor recently exploited in the supply chain attack on 3CX.

Microsoft: NSO Group-Like 'QuaDream' Actor Selling Mobile Spyware to Governments

Researchers at Microsoft have discovered links between a threat group tracked as DEV-0196 and an Israeli private-sector company, QuaDream, that sells a platform for exfiltrating data from mobile devices.

LATEST FROM THE EDGE

Designing Tabletop Exercises That Actually Thwart Attacks

Have you ever wondered how they design blue team exercises? One ransomware and cyber extortion simulation demonstrates the best practices.

LATEST FROM DR TECHNOLOGY

Why the US Needs Quantum-Safe Cryptography Deployed Now

Quantum computers might be a decade away, but guess how long it will take to switch systems over to post-quantum cryptography?

The 10 Most Impactful Types of Vulnerabilities for Enterprises Today