Dark Reading Weekly -- May 18, 2023

Severe RCE Bugs Open Thousands of Industrial IoT Devices to Cyberattack

Researchers found 11 vulnerabilities in products from three industrial cellular router vendors that attackers can exploit through various vectors, bypassing all security layers.

BianLian Cybercrime Group Changes Up Extortion Methods, Warns CISA

CISA urges small and midsized organizations as well as critical infrastructure to implement mitigations immediately to shield themselves from further data exfiltration attacks.

Attackers Target macOS With 'Geacon' Cobalt Strike Tool

Threat actors seen using Go-language implementation of the red-teaming tool on Intel and Apple silicon-based macOS systems.

Lemon Group Uses Millions of Pre-Infected Android Phones to Enable Cybercrime Enterprise

Lemon Group's Guerrilla malware model an example of how threat actors are monetizing compromised Android devices, researchers say.

TSA Official: Feds Improved Cybersecurity Response Post-Colonial Pipeline

US Transportation Security Agency (TSA) administrator reflects on how the Colonial Pipeline incident has moved the needle in public-private cooperation.

Microsoft Teams Features Amp Up Orgs' Cyberattack Exposure

It's as they say: Teams is only as strong as its weakest links. Microsoft's collaboration platform offers Tabs, Meetings, and Messages functions, and they all can be exploited.

Dragos Employee Hacked, Revealing Ransomware, Extortion Scheme

Attackers compromised the personal email of a new employee and, when the initial attack failed, attempted through socially engineered messages to get the company to pay them off.

RA Ransomware Group Emerges With Custom Spin on Babuk

The freshly minted ransomware gang is customizing leaked Babuk source code to go after cyber targets in the US and South Korea — and it's expanding its operations quickly.

Microsoft Advisories Are Getting Worse

A predictable patch cadence is nice, but the software giant can do more.

Talking Security Strategy: Cybersecurity Has a Seat at the Boardroom Table

Pending new SEC rules reinforce how integral cybersecurity is to modern business operations, and will help close the gap between security teams and those making policy decisions.

I Was an RSAC Innovation Sandbox Judge — Here's What I Learned

Three pieces of advice to startups serious about winning funding and support for their nascent companies: Articulate your key message clearly, have the founder speak, and don't use a canned demo.

Name That Toon: One by One

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

AI Is About to Be Everywhere: Where Will Regulators Be?

Regulators should apply a healthy skepticism to generative AI developments to guarantee a competitive marketplace.

How Enterprises Are Managing Application Security Risks in a Heightened Threat Environment