Dark Reading Daily -- February 08, 2023

Ongoing VMware ESXi Ransomware Attack Highlights Inherent Virtualization Risks

The global assault on vulnerable VMware hypervisors may have been mitigated by updating to the latest version of the product, but patch management is only part of the story.

Fresh, Buggy Clop Ransomware Variant Targets Linux Systems

For the moment, victims can decrypt data without paying a ransom. But Clop is a ransomware variant that has caused havoc on Windows systems, so that's bound to change.

'Money Lover' Finance App Exposes User Data

A broken access control vulnerability could have led to dangerous follow-on attacks for users of the money-management app.

Backdoor in Dingo Cryptocurrency Allows Creator to Steal (Nearly) Everything

A tax variable in the software implementing the Dingo Token allows the creators to charge 99% in fees per transaction, essentially stealing funds, an analysis finds.

DPRK Using Unpatched Zimbra Devices to Spy on Researchers

Lazarus Group used a known Zimbra bug to steal data from medical and energy researchers.

New Banking Trojan Targeting 100M Pix Payment Platform Accounts

New malware demonstrates how threat actors are pivoting toward payment platform attacks, researchers say.

Optimizing Cybersecurity Investments in a Constrained Spending Environment

Three ways to stay safe in an economically uncertain 2023.

With TikTok Bans, the Time for Operational Governance Is Now

Emerging risks and trends need to be monitored, but cybersecurity challenges can be fixed with a focus on the fundamentals.

Global Ransomware Attack on VMware EXSi Hypervisors Continues to Spread

The fresh "ESXiArgs" malware is exploiting a 2-year-old RCE security vulnerability (tracked as CVE-2021-21974), resulting in thousands of unpatched servers falling prey to the campaign.

How Cybercriminals Are Operationalizing Money Laundering and What to Do About It

It's time to share threat intelligence and prioritize digital literacy and cyber hygiene to stem the rising money laundering tide.

Patching & Passwords Lead the Problem Pack for Cyber-Teams

Despite growing awareness, organizations remain plagued with unpatched vulnerabilities and weaknesses in credential policies.

Crypto Drainers Are Ready to Ransack Investor Wallets

Cryptocurrency drainers are the latest hot ticket being used in a string of lucrative cyberattacks aimed at virtual currency investors.

LATEST FROM THE EDGE

5 Ways to Survive Scam Season — or Rather, Tax Season

Security pros need to look beyond user education to find and disarm fraudulent actors.

LATEST FROM DR TECHNOLOGY

Cloud Apps Still Demand Way More Privileges Than They Use

Hackers can't steal a credential that doesn't exist.

The Promise and Reality of Cloud Security