Dark Reading Daily -- April 13, 2023

Microsoft: NSO Group-Like 'QuaDream' Actor Selling Mobile Spyware to Governments

Researchers at Microsoft have discovered links between a threat group tracked as DEV-0196 and an Israeli private-sector company, QuaDream, that sells a platform for exfiltrating data from mobile devices.

Lazarus Group's 'DeathNote' Cluster Pivots to Defense Sector

Usually focused on going after cryptocurrency organizations, the threat actor has begun targeting defense companies around the world.

1M+ WordPress Sites Hacked via Zero-Day Plug-in Bugs

A wide-ranging campaign to inject malicious code into WordPress-run websites has been ongoing for at least five years.

FBI & FCC Warn on 'Juice Jacking' at Public Chargers, but What's the Risk?

Hackers can compromise public charging hubs to steal data, install malware on phones, and more, threatening individuals and businesses alike.

LastPass Breach Reveals Important Lessons

Devastating cyberattacks often can be prevented with basic cybersecurity measures.

Data on 400K Kodi Forum Members Stolen and Put Up for Sale

Open source media player Kodi still hasn't recovered its forum and plans to redeploy it on a new server with software update.

Gartner: Human-Centric Design Is Top Cybersecurity Trend for 2023

In order to reduce cybersecurity risks and failures, organizations will need to focus on employees, management, and new operating models.

Microsoft Patches 97 CVEs, Including Zero-Day & Wormable Bugs

The April 2023 Patch Tuesday security update also included a reissue of a fix for a 10-year-old bug that a threat actor recently exploited in the supply chain attack on 3CX.

How Password Managers Can Get Hacked

Password managers aren't foolproof, but they do help mitigate risks from weak credentials and password reuse. Following best practices can contribute to a company's defenses.

Where Are the Women? Making Cybersecurity More Inclusive

Stepped-up recruiting efforts along with better work-life balance policies and mentoring and recruitment programs will help balance the scales.

7 Things Your Ransomware Response Playbook Is Likely Missing

Incident response experts share their secrets for success when it comes to creating a professional-grade ransomware response playbook. Are you ready for the worst?

LATEST FROM THE EDGE

When Banking Laws Don't Protect Consumers From Cybertheft

If attackers use your stolen login information or set up wire transfers, you might be out of luck.

LATEST FROM DR TECHNOLOGY

Google Tackles Open Source Security With New Dependency Service

With deps.dev API and Assured OSS, Google is addressing the common challenges software developers face in securing the software supply chain.

The 10 Most Impactful Types of Vulnerabilities for Enterprises Today