Dark Reading Daily -- May 25, 2023

'Volt Typhoon' China-Backed APT Infiltrates US Critical Infrastructure Orgs

According to Microsoft and researchers, the state-sponsored threat actor could very well be setting up a contingency plan for disruptive attacks on the US in the wake of an armed conflict in the South China Sea.

Google's .zip, .mov Domains Give Social Engineers a Shiny New Tool

Security professionals warn that Google's new top-level domains, .zip and .mov, pose social engineering risks while providing little reason for their existence.

OAuth Flaw in Expo Platform Affects Hundreds of Third-Party Sites, Apps

A cybersecurity vulnerability found in an implementation of the social login functionality opens the door to account takeovers and more.

SuperMailer Abuse Bypasses Email Security for Super-Sized Credential Theft

Secure email gateways and end users alike are being fooled by a cyberattack campaign that's enjoying skyrocketing volumes against businesses in every industry, globally.

Threat Actors Compromise Barracuda Email Security Appliances

The company's ESG appliances were breached, but their other services remain unaffected by the compromise.

5 Questions to Ask When Evaluating a New Cybersecurity Technology

Any new cybersecurity technology should be not just a neutral addition to a security stack but a benefit to the other technologies or people managing them.

How Universities Can Bridge Cybersecurity's Gender Gap

It's time to invest in initiatives that engage young women in cybersecurity early and often.

(Sponsored Article) How to Protect Your Organization From Vulnerabilities

Cobalt's fifth edition of "The State of Penetration Testing Report" taps into data from 3,100 pen tests and more than 1,000 responses from security practitioners.

Microsoft: BEC Attackers Evade 'Impossible Travel' Flags With Residential IP Addresses

Threat actors are circumventing geo-location-based security detections, using a combination of cybercrime-as-a-service platforms and the purchasing of local IP addresses.

Enterprises Must Prepare Now for Shorter TLS Certificate Lifespans

Shorter certificate lifespans are beneficial, but they require a rethink of how to properly manage them.

PyPI Shuts Down Over the Weekend, Says Incident Was Overblown

The climate of concern around open source security and supply chain attacks may have caused a small story to become a big one.

Bridgestone CISO: Lessons From Ransomware Attack Include Acting, Not Thinking

A February 2022 attack knocked the giant tire maker's North American operations offline for several days.

LATEST FROM DR GLOBAL

Israeli Shipping, Logistics Companies Targeted in Watering Hole Attacks

Researchers say the Iranian nation-state actor known as Tortoiseshell could be behind the attacks.

LATEST FROM THE EDGE

Improving Cybersecurity Requires Building Better Public-Private Cooperation

Security vendors, businesses, and US government agencies need to work together to fight ransomware and protect critical infrastructure.

LATEST FROM DR TECHNOLOGY

Enterprises Rely on Multicloud Security to Protect Cloud Workloads

As enterprises adopt multicloud, the security picture has become foggy. Cloud workload protection platforms and distributed firewalls are creating clarity.

How Enterprises Are Managing Application Security Risks in a Heightened Threat Environment