Dark Reading Daily -- February 13, 2023

Reddit Hack Shows Limits of MFA, Strengths of Security Training

A tailored spear-phishing attack successfully convinced a Reddit employee to hand over their credentials and their one-time password, but soon after, the same worker notified security.

Attacker Allure: A Look at the Super Bowl's Operational Cyber-Risks

Event organizers should be exercising various cyberattack scenarios to ensure they have the proper checks and balances in place to respond accordingly and maintain resilience.

Trickbot Members Sanctioned for Pandemic-Era Ransomware Hits

The US Treasury Department linked the notorious cybercrime gang to Russian Intelligence Services because cyberattacks that disrupted hospitals and other critical infrastructure align with Russian state interests.

MagicWeb Mystery Highlights Nobelium Attacker's Sophistication

The authentication bypass used by the Nobelium group, best known for the supply chain attack on SolarWinds, required a massive, real-time investigation to uncover, Microsoft says.

Malicious Game Mods Target Dota 2 Game Users

Valve's unpatched JavaScript engine and incomplete modification vetting process for Steam-delivered mods led to user systems being backdoored.

Addressing the Elephant in the Room: Getting Developers & Security Teams to Work Together

Bridging the divide between developers and security can create a culture change organically.

Phishing Surges Ahead, as ChatGPT & AI Loom

AI and phishing-as-a-service (PaaS) kits are making it easier for threat actors to create malicious email campaigns, which continue to target high-volume applications using popular brand names.

Lessons From the Cold War: How Quality Trumps Quantity in Cybersecurity

High-quality tools and standards remain critical components in cybersecurity efforts even as budgets decline. It's important that staff knows response procedures and their roles, and also communicates well.

NewsPenguin Goes Phishing for Maritime & Military Secrets

A sophisticated cyber-espionage attack against high-value targets attending a maritime technology conference in Pakistan this weekend has been in the works since last year.

In Perfect Harmony: Cybersecurity Regulation Harmonization

By simplifying compliance management, security and risk teams can focus on managing operational risk, not compliance risk — and better counter threats.

7 Critical Cloud Threats Facing the Enterprise in 2023

From shadow data to misconfigurations, and overpermissioning to multicloud sprawl, Dark Reading's cloud security slideshow helps security pros understand the threat horizon.

LATEST FROM THE EDGE

5 Ways to Survive Scam Season — or Rather, Tax Season

Security pros need to look beyond user education to find and disarm fraudulent actors.

LATEST FROM DR TECHNOLOGY

Cloud Apps Still Demand Way More Privileges Than They Use

Hackers can't steal a credential that doesn't exist.

The Promise and Reality of Cloud Security