Dark Reading Daily -- June 14, 2023

Microsoft Fixes 69 Bugs, but None Are Zero-Days

The June 2023 Patch Tuesday security update included fixes for a bypass for two previously addressed issues in Microsoft Exchange and a critical elevation of privilege flaw in SharePoint Server.

Chinese Threat Actor Abused ESXi Zero-Day to Pilfer Files From Guest VMs

Mandiant's ongoing investigation of UNC3886 has uncovered new details of threat actors' TTPs.

Analysis: Social Engineering Drives BEC Losses to $50B Globally

Threat actors have grown increasingly sophisticated in applying social engineering tactics against their victims, which is key to this oft-underrated cybercriminal scam's success.

Threat actors have created over 3,000 domains, some as old as two years, to lure in customers to false, name brand websites for personal financial gain.

How Security Leaders Should Approach Cybersecurity Startups

Vendors and buyers both have the power to make the industry a better place. What's needed is more collaboration, mutual support, and respect.

Why Critical Infrastructure Remains a Ransomware Target

While protecting critical infrastructure seems daunting, here are some critical steps the industry can take now to become more cyber resilient and mitigate risks.

(Sponsored Article) The Key to Zero Trust Identity Is Automation

In a zero-trust world, a trusted identity is the key that unlocks access for people and devices to enter your enterprise’s key networks, systems, and resources.

Supply Chain Attack Defense Demands Mature Threat Hunting

Active threat hunting is the best protection against supply chain attacks like MOVEit and 3CX, experts say.

DOS Attacks Dominate, but System Intrusions Cause Most Pain

In the latest Verizon "Data Breach Investigations Report," denial-of-service attacks are the most common type of security incident, but when it comes to breaches, nearly four-in-ten attackers compromise systems.

Doing Less With Less: Focusing on Value

Always reach for defense in depth with proposed security changes. Measure and test results, focus on items of greatest impact, and get C-suite members involved to drive better outcomes.

Researchers Report First Instance of Automated SaaS Ransomware Extortion

The attack highlights growing interest among threat actors to target data from software-as-a-service providers.

LATEST FROM DR GLOBAL

'Stealth Soldier' Attacks Target Libyan Government Entities With Surveillance Malware

Surveillance malware targets Libyan government entities, with possible links to a 2019 Egypt attack campaign.

LATEST FROM THE EDGE

Ways to Help Cybersecurity's Essential Workers Avoid Burnout

To support and retain the people who protect assets against bad actors, organizations should create a more defensible environment.

LATEST FROM DR TECHNOLOGY

2 Lenses for Examining the Safety of Open Source Software

Improving the security of open source repositories while keeping malicious components out requires a combination of technology and people.

How to Use Threat Intelligence to Mitigate Third-Party Risk