Dark Reading Daily -- September 14, 2022

Microsoft Quashes Actively Exploited Zero-Day, Wormable Critical Bugs

In Microsoft's lightest Patch Tuesday update of the year so far, several security vulnerabilities stand out as must-patch, researchers warn.

ShadowPad Threat Actors Return With Fresh Government Strikes, Updated Tools

Cyber spies are using legitimate apps for DLL sideloading, deploying an updated range of malware, including the new "Logdatter" info-stealer.

Cyberattackers Abuse Facebook Ad Manager in Savvy Credential-Harvesting Campaign

Facebook lead-generation forms are being repurposed to collect passwords and credit card information from unsuspecting Facebook advertisers.

Lorenz Ransomware Goes After SMBs via Mitel VoIP Phone Systems

The ransomware gang has been seen exploiting a Mitel RCE flaw discovered in VoIP devices in April (and patched in July) to perform double-extortion attacks.

U-Haul Customer Contract Search Tool Compromised

Password compromise led to unauthorized access to a customer contract search tool over a five-month window, according to the company.

Business Security Starts With Identity

How identity-centric security can support business objectives.

Name That Toon: Shiver Me Timbers!

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Vulnerability Exploits, Not Phishing, Are the Top Cyberattack Vector for Initial Compromise

A slew of Microsoft Exchange vulnerabilities (including ProxyLogon) fueled a surge in attacks targeting software flaws in 2021, but the trend has continued this year.

Attackers Exploit Zero-Day WordPress Plug-in Vulnerability in BackupBuddy

The critical flaw in BackupBuddy is one of thousands of security issues reported in recent years in products that WordPress sites use to extend functionality.

Security Awareness Training Must Evolve to Align With Growing E-Commerce Security Threats

Users must continually be made aware of new threats, including attacks targeting shipping, the supply chain, email, and hybrid workers.

Attackers Can Compromise Most Cloud Data in Just 3 Steps

An analysis of cloud services finds that known vulnerabilities typically open the door for attackers, while insecure cloud architectures allow them to gain access to the crown jewels.

LATEST FROM THE EDGE

Key Takeaways From the Twitter Whistleblower's Testimony

Twitter did not know what data it had nor who had access to it, Peiter "Mudge" Zatko told Congressional lawmakers during a Senate panel hearing.

LATEST FROM DR TECHNOLOGY

Bishop Fox Releases Cloud Enumeration Tool CloudFox

CloudFox is a command-line tool to help penetration testers understand unknown cloud environments.

Ransomware Resilience and Response: The Next-Generation