Dark Reading Daily -- November 15, 2023

Microsoft Zero-Days Allow Defender Bypass, Privilege Escalation

Another two bugs in this month's set of fixes for 63 CVEs were publicly disclosed previously but have not been exploited yet.

21 Vulnerabilities Discovered in Crucial IT-OT Connective Routers

In this Black Hat Europe preview, devices bridging critical machinery with the wider Internet are exposed and subject to numerous supply chain-induced bugs.

Danish Energy Attacks Portend Targeting More Critical Infrastructure

Targeted attacks against two dozen related companies is just the latest evidence that hackers want a piece of energy.

Zero-Days in Edge Devices Become China's Cyber Warfare Tactic of Choice

While China is already among the world's most formidable threat actors, a focus on exploiting public-facing appliances makes its state-sponsored APTs more dangerous than ever.

Royal Ransom Demands Exceed $275M, Rebrand in Offing

The swift-moving ransomware crew continues to evolve quickly and has already attacked more than 350 victims since it was first detected just over a year ago.

Steps CISOs Should Take Before, During & After a Cyberattack

By creating a plan of action, organizations can better respond to attacks.

Google Goes After Scammers Abusing Its Bard AI Chatbot

A pair of lawsuits are part of a wider strategy to establish guardrails preventing AI-powered scams, frauds, and harassment, Google's general counsel says.

(Sponsored Article) Security Is a Process, Not a Tool

Process failures are the root cause of most serious cybersecurity incidents. We need to treat security as a process issue, not try to solve it with a collection of tools.

'Hunters International' Cyberattackers Take Over Hive Ransomware

Hunters International appears to have acquired Hive ransomware from its original operators and may be seeking to cash in on the malware's reputation.

Ransomware Mastermind Uncovered After Oversharing on Dark Web

Meet "farnetwork," one of the most prolific RaaS operators around, who spilled too many details during an affiliate "job interview."

Meet Your New Cybersecurity Auditor: Your Insurer

As cyber insurance gets more expensive and competitive, security decision-makers have actionable opportunities to strengthen their cyber defenses.

Identity Alone Won't Save Us: The TSA Paradigm and MGM's Hack

To combat sophisticated threats, we need to improve how we approach authorization and access controls.

SEC Suit Ushers in New Era of Cyber Enforcement

A federal push to enforce cybersecurity requirements is holding public companies and government contractors accountable as a matter of law and for national security.

LATEST FROM THE EDGE

Make Changes to Be Ready for the New SEC Cybersecurity Disclosure Rule

Mandiant/Google Cloud's Jill C. Tyson and Dark Reading's Terry Sweeney on how companies can better plan and prepare for the Securities and Exchange Commission's new cybersecurity disclosure rule.

LATEST FROM DR TECHNOLOGY

HARmor Cleans, Sanitizes, Encrypts HAR Files

Okta's breach highlights the importance of sanitizing the data logged in HAR files before sharing them.

LATEST FROM DR GLOBAL

Molerats Group Wields Custom Cybertool to Steal Secrets in the Middle East

The so-called TA402 group continues to focus on cyber espionage against government agencies with the "IronWInd" malware.

Key DevSecOps Principles for Enterprise Mobile App Development