Dark Reading Daily -- July 26, 2022

Rare 'CosmicStrand' UEFI Rootkit Swings into Cybercrime Orbit

The firmware threat offers ultimate stealth and persistence — and may be distributed via tainted firmware components in a supply chain play, researchers theorize.

Supercharged Version of Amadey Infostealer & Malware Dropper Bypasses AVs

Several threat actors used Amadey Bot previously to steal information and distribute malware such as the GandCrab ransomware and the FlawedAmmy RAT.

Critical Filewave MDM Vulnerabilities Allow Attackers Full Mobile Device Control

Two previously unknown critical vulnerabilities within FileWave’s multiplatform MDM system could grant malicious actors access to the platform's most privileged user account.

Getting Ahead of Supply Chain Attacks

Attackers are willing to replicate entire networks, purchase domains, and persist for months, not to mention spend significantly to make these campaigns successful.

T-Mobile Pitches $4-Per-Customer Settlement for Data Leak Impacting 80M People

After leaking 80 million US customer data records in a cyberattack last summer, T-Mobile offers to settle a wide-ranging class action suit for just $350 million.

Qakbot Is Back With a New Trick: DLL Sideloading

In the latest iteration, Qakbot operators are using DLL sideloading to deliver malware, a technique that places legitimate and malicious files together in a common directory to avoid detection.

ICYMI: Neopets & the Gaming Problem; SolarWinds Hackers Are Back; Google Ads Abused

Dark Reading's weekly roundup of all the OTHER important stories of the week.

What Firewalls Can — and Can't — Accomplish

Understanding the limitations of firewalls is important to protecting the organization from evolving threats.

What InfoSec Pros Can Teach the Organization About ESG

Security pros' experience with transparency and evaluating third-party partners positions them to act as key environmental, social, and governance advisers.

Critical Bugs Threaten to Crack Atlassian Confluence Workspaces Wide Open

A hardcoded password associated with the Questions for Confluence app has been publicly released, which will likely lead to exploit attempts that give cyberattackers access to all Confluence content.

LATEST FROM THE EDGE

Why Layer 8 Is Great

To help discern legitimate traffic from fraud, it helps to understand user intent as shown through their behavior.

LATEST FROM DR TECHNOLOGY

OpenFHE Brings New Encryption Tools to Developers

The open source fully homomorphic encryption library from Duality Technologies is intended to help developers build their own FHE-enabled applications.

Implementing Zero Trust In Your Enterprise: How to Get Started