Dark Reading Weekly -- September 08, 2022

Next-Gen Linux Malware Takes Over Devices With Unique Tool Set

The Shikitega malware takes over IoT and endpoint devices, exploits vulnerabilities, uses advanced encoding, abuses cloud services for C2, installs a cryptominer, and allows full remote control.

EvilProxy Commodifies Reverse-Proxy Tactic for Phishing, Bypassing 2FA

The phishing-as-a-service offering targets accounts from tech giants, and also has connections to PyPI phishing and the Twilio supply chain attack.

Holiday Inn Owner InterContinental Has a Breach Trend

After a high-profile 2017 breach and a Holiday Inn ransomware hit earlier this year, IHG confirms that its booking channels and applications have been disrupted in yet another cyberattack.

Iran-Linked APT Cozies Up to 'Enemies' in Trust-Based Spy Game

APT42 is posing as a friend to people considered threats to the government, using a raft of different tools to steal relevant info and perform surveillance.

Mysterious 'Worok' Group Launches Spy Effort With Obfuscated Code, Private Tools

The threat actor — whose techniques and procedures do not match known groups — has created custom attack tools, including a program that hides scripts in .PNG images.

Researchers Spot Snowballing BianLian Ransomware Gang Activity

The operators of the emerging cross-platform ransomware BianLian increased their command and control infrastructure this month, indicating an acceleration in their operational pace.

Raspberry Robin Malware Connected to Russian Evil Corp Gang

Infections attributed to the USB-based worm have taken off, and now evidence links the malware to Dridex and the sanctioned Russian cybercriminal group Evil Corp.

AWS Tokens Lurking in Android, iOS Apps Crack Open Corporate Cloud Data

Thousands of corporate mobile apps developed by businesses for use by their customers contain hardcoded AWS tokens that can be easily extracted and used to access the full run of corporate data stored in cloud buckets.

Code-Injection Bugs Bite Google, Apache Open Source GitHub Projects

The insecurities exist in CI/CD pipelines and can be used by attackers to subvert modern development and roll out malicious code at deployment.

Apple Quietly Releases Another Patch for Zero-Day RCE Bug

Apple continues a staged update process to address a WebKit vulnerability that allows attackers to craft malicious Web content to load malware on affected devices.

Internet Security & Encryption Pioneer Peter Eckersley Passes at 43

The founder of Let's Encrypt and an EFF technologist, Eckersley devoted his life's work to making the Internet safer and more secure.

Fighting Ransomware Takes an Army: Our Public & Private Sector Soldiers Join Forces

Continued collaboration will help win the fight as cybersecurity remains a national priority. International and public-private cooperation is helping stem the damage from ransomware threats and cyberattacks.

The Makings of a Successful Threat-Hunting Program

Threat hunters can help build defenses as they work with offensive security teams to identify potential threats and build stronger threat barriers.

Some Employees Aren't Just Leaving Companies — They're Defrauding Them

Here are a few measures your organization can implement to minimize fraudulent behavior and losses.

Name That Edge Toon: Mime's the Word

Come up with a clever caption, and our panel of experts will reward the winner with a $25 Amazon gift card.

Botnets in the Age of Remote Work

Here are some strategies for protecting the business against botnets poised to take advantage of remote-work vulnerabilities.

Building & Maintaining an Effective Remote Access Strategy