Dark Reading Daily -- June 15, 2023

Russian APT 'Cadet Blizzard' Behind Ukraine Wiper Attacks

Microsoft says Cadet Blizzard wielded a custom wiper malware in the weeks leading up to Russia's invasion of Ukraine, and it remains capable of wanton destruction.

Illinois Hospital Closure Showcases Ransomware's Existential Threat

St. Margaret's Health is shutting down due to a 2021 ransomware attack and other factors. It's an object lesson for how small and rural healthcare facilities face grave cyber-risk when extortionists come calling.

Fortinet: Patched Critical Flaw May Have Been Exploited

Users urged to apply updates to FortiOS SSL-VPN after attackers may have leveraged a recently discovered vulnerability in attacks against government, manufacturing, and critical infrastructure organizations.

XSS Vulnerabilities Found in Microsoft Azure Cloud Services

Microsoft quickly issued patches for the two security issues, which could allow unauthorized access to cloud sessions.

Moving the Cyber Industry Forward Requires a Novel Approach

CISOs need to be better equipped with strategic metrics and proof points to better align their organization for defense against the ever-changing threat landscape.

It's time to include messaging tool security in your cloud security program. Good first steps include tightening filter parameters on Slack and Teams.

(Sponsored Article) How to Protect Your Organization From Vulnerabilities

Cobalt's fifth edition of "The State of Penetration Testing Report" taps into data from 3,100 pen tests and more than 1,000 responses from security practitioners.

Analysis: Social Engineering Drives BEC Losses to $50B Globally

Threat actors have grown increasingly sophisticated in applying social engineering tactics against their victims, which is key to this oft-underrated cybercriminal scam's success.

Chinese Threat Actor Abused ESXi Zero-Day to Pilfer Files From Guest VMs

Mandiant's ongoing investigation of UNC3886 has uncovered new details of threat actors' TTPs.

Why Critical Infrastructure Remains a Ransomware Target

While protecting critical infrastructure seems daunting, here are some critical steps the industry can take now to become more cyber resilient and mitigate risks.

How Security Leaders Should Approach Cybersecurity Startups

Vendors and buyers both have the power to make the industry a better place. What's needed is more collaboration, mutual support, and respect.

Microsoft Fixes 69 Bugs, but None Are Zero-Days

The June 2023 Patch Tuesday security update included fixes for a bypass for two previously addressed issues in Microsoft Exchange and a critical elevation of privilege flaw in SharePoint Server.

THE LATEST FROM THE EDGE

Cryptocurrency Attacks Quadrupled as Cybercriminals Cash In

Attackers continue to attempt to steal Bitcoin and other virtual coins, with a 40% increase in phishing attacks and fourfold increase in incidents.

THE LATEST FROM DR TECHNOLOGY

Network-Security Testing Standard Nears Prime Time

NetSecOpen recently released a new draft of its testing and benchmarking guide, which could be adopted later this year.

THE LATEST FROM DR GLOBAL

'PostalFurious' SMS Attacks Target UAE Citizens for Data Theft

SMS campaigns targeting members of the public in the United Arab Emirates have been detected.

How to Use Threat Intelligence to Mitigate Third-Party Risk