Dark Reading Daily -- June 26, 2023

Microsoft Teams Attack Skips the Phish to Deliver Malware Directly

Exploiting a flaw in how the app handles communication with external tenants gives threat actors an easy way to send malicious files from a trusted source to an organization's employees, but no patch is imminent.

NSA: BlackLotus BootKit Patching Won't Prevent Compromise

It's unclear why the NSA issued in-depth mitigation guidance for the software boot threat now, but orgs should take steps to harden their environments.

Millions of Repos on GitHub Are Potentially Vulnerable to Hijacking

Many organizations are unwittingly exposing users of their code repositories to repojacking when renaming projects, a new study shows.

Deception Technologies Have a Maturity Problem

While there's plenty of upside to rolling out deception technologies, it's not clear if cybersecurity leaders — or their organizations — are ready for them.

Black Hat Asia 2023: Cybersecurity Maturity and Concern in Asia

Black Hat Asia 2023 showed that cybersecurity is nascent among organizations in Asia with opportunities for improvement.

How Government Contractors & Agencies Should Navigate New Cyber Rules

The impending regulations highlight the increasing importance of enhanced network security and regulatory compliance across the government sector.

Suspicious Smartwatches Mailed to US Army Personnel

Unknown senders have been shipping smartwatches to service members, leading to questions regarding what kind of ulterior motive is at play, malware or otherwise.

(Sponsored Article) How Active Directory Bridging Extends Security Automation to Hybrid IT Environments

AD bridging extends the reach of your AD domain to non-Windows systems, providing centralized security, single sign-on, and compliance.

Patch Now: Cisco AnyConnect Bug Exploit Released in the Wild

A ready-made, low-complexity path to pwning the popular enterprise VPN clients for remote workers is now circulating in the wild.

Lessons From a Pen Tester: 3 Steps to Stay Safer

From hardening Windows systems to adding access control and segmenting the network, there are steps organizations can take to better secure corporate data.

5 Steps for Minimizing Dark Data Risk

Dark data may be your most elusive asset, but it can also be your most costly if you don't protect it.

Azure AD 'Log in With Microsoft' Authentication Bypass Affects Thousands

The "nOAuth" attack allows cross-platform spoofing and full account takeovers, and enterprises need to remediate the issue immediately, researchers warn.

LATEST FROM DR TECHNOLOGY

ITDR Combines and Refines Familiar Cybersecurity Approaches

Identity threat detection and response adds user entity behavioral analytics to fraud detection, creating a powerful tool for real-time protection.

LATEST FROM THE EDGE

Why Legacy System Users Prioritize Uptime Over Security

For line-of-business execs, the fear of mission-critical systems grinding to a halt overrides their cybersecurity concerns. How can CISOs overcome this?

LATEST FROM DR GLOBAL

South African Female Students Offered Cyber Scholarship

Women of color are being offered a scholarship opportunity in South Africa — the offer will cover costs for pursuing a cyber career and encourage greater diversity of those studying cybersecurity courses.

How to Use Threat Intelligence to Mitigate Third-Party Risk