Dark Reading Daily -- May 25, 2022

'There's No Ceiling': Ransomware's Alarming Growth Signals a New Era, Verizon DBIR Finds

Ransomware has become so efficient, and the underground economy so professional, that traditional monetization of stolen data may be on its way out.

Microsoft Elevation-of-Privilege Vulnerabilities Spiked Again in 2021

But there was a substantial drop in the overall number of critical vulnerabilities that the company disclosed last year, new analysis shows.

DeFi Is Getting Pummeled by Cybercriminals

Decentralized finance lost $1.8 billion to cyberattacks last year — and 80% of those events were the result of vulnerable code, analysts say.

New Attack Shows Weaponized PDF Files Remain a Threat

Notable new infection chain uses PDF to embed malicious files, load remote exploits, shellcode encryption, and more, new research shows.

Crypto Hacks Aren't a Niche Concern; They Impact Wider Society

Million-dollar crypto heists are becoming more common as the currency starts to go mainstream; prevention and enforcement haven't kept pace.

Strong Password Policy Isn't Enough, Study Shows

New analysis reveals basic regulatory password requirements fall far short of providing protection from compromise.

After the Okta Breach, Diversify Your Sources of Truth

What subsequent protections do you have in place when your first line of defense goes down?

Partial Patching Still Provides Strong Protection Against APTs

Organizations that deploy updates only after a vulnerability is disclosed apply far fewer updates and do so at a lower cost than those that stay up to date on all of their software, university researchers say.

Majority of Kubernetes API Servers Exposed to the Public Internet

Shadowserver Foundation researchers find 380,000 open Kubernetes API servers.

EDITORS' CHOICE

Malicious Python Repository Package Drops Cobalt Strike on Windows, macOS & Linux Systems

The PyPI "pymafka" package is the latest example of growing attacker interest in abusing widely used open source software repositories.

LATEST FROM THE EDGE

New Connecticut Privacy Law Makes Path to Compliance More Complex

As states address privacy with ad-hoc laws, corporate compliance teams try to balance yet another set of similar but diverging requirements.

LATEST FROM DR TECHNOLOGY

DBIR Makes a Case for Passwordless

The 2022 Data Breach Investigations Report repeatedly makes the point that criminals are stealing credentials to carry out their attacks.

Incorporating a Prevention Mindset into Threat Detection and Response