Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

News & Commentary
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff, Quick Hits
Joyce has long worked in US cybersecurity leadership, most recently serving as the NSA's top representative in the UK.
By Dark Reading Staff , 1/15/2021
Comment0 comments  |  Read  |  Post a Comment
Successful Malware Incidents Rise as Attackers Shift Tactics
Robert Lemos, Contributing WriterNews
As employees moved to working from home and on mobile devices, attackers followed them and focused on weekend attacks, a security firm says.
By Robert Lemos Contributing Writer, 1/15/2021
Comment0 comments  |  Read  |  Post a Comment
'Chimera' Threat Group Abuses Microsoft & Google Cloud Services
Dark Reading Staff, Quick Hits
Researchers detail a new threat group targeting cloud services to achieve goals aligning with Chinese interests.
By Dark Reading Staff , 1/14/2021
Comment0 comments  |  Read  |  Post a Comment
Businesses Struggle with Cloud Availability as Attackers Take Aim
Kelly Sheridan, Staff Editor, Dark ReadingNews
Researchers find organizations struggle with availability for cloud applications as government officials warn of cloud-focused cyberattacks.
By Kelly Sheridan Staff Editor, Dark Reading, 1/14/2021
Comment0 comments  |  Read  |  Post a Comment
NSA Recommends Using Only 'Designated' DNS Resolvers
Dark Reading Staff, Quick Hits
Agency provides guidelines on securely deploying DNS over HTTPS, aka DoH.
By Dark Reading Staff , 1/14/2021
Comment0 comments  |  Read  |  Post a Comment
SolarWinds Attackers May Have Hit Mimecast, Driving New Concerns
Dark Reading Staff, Quick Hits
Mimecast no longer uses the SolarWinds Orion network management software that served as an attack vector for thousands of organizations.
By Dark Reading Staff , 1/13/2021
Comment0 comments  |  Read  |  Post a Comment
Huntress Acquires EDR Technology From Level Effect
Dark Reading Staff, Quick Hits
Huntress seeks to improve its detection and response capabilities with a more comprehensive view of endpoint security.
By Dark Reading Staff , 1/13/2021
Comment0 comments  |  Read  |  Post a Comment
More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
A third piece of malware is uncovered, but there are still plenty of unknowns about the epic attacks purportedly out of Russia.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/12/2021
Comment1 Comment  |  Read  |  Post a Comment
United Nations Security Flaw Exposed 100K Staff Records
Dark Reading Staff, Quick Hits
Security researchers have disclosed a vulnerability they exploited to access more than 100,000 private employee records.
By Dark Reading Staff , 1/12/2021
Comment0 comments  |  Read  |  Post a Comment
Microsoft Defender Zero-Day Fixed in First Patch Tuesday of 2021
Kelly Sheridan, Staff Editor, Dark ReadingNews
Microsoft patched 83 bugs, including a Microsoft Defender zero-day and one publicly known elevation of privilege flaw.
By Kelly Sheridan Staff Editor, Dark Reading, 1/12/2021
Comment0 comments  |  Read  |  Post a Comment
Security Operations Struggle to Defend Value, Keep Workers
Robert Lemos, Contributing WriterNews
Companies continue to value security operations centers but the economics are increasingly challenging, with high analyst turnover and questions raised over return on investment.
By Robert Lemos Contributing Writer, 1/12/2021
Comment0 comments  |  Read  |  Post a Comment
Intel's New vPro Processors Aim to Help Defend Against Ransomware
Kelly Sheridan, Staff Editor, Dark ReadingNews
The newest Intel Core vPro mobile platform gives PC hardware a direct role in detecting ransomware attacks.
By Kelly Sheridan Staff Editor, Dark Reading, 1/11/2021
Comment0 comments  |  Read  |  Post a Comment
New Tool Sheds Light on AppleScript-Obfuscated Malware
Robert Lemos, Contributing WriterNews
The AEVT decompiler helped researchers analyze a cryptominer campaign that used AppleScript for obfuscation and will help reverse engineers focused on other Mac OS malware.
By Robert Lemos Contributing Writer, 1/11/2021
Comment0 comments  |  Read  |  Post a Comment
Malware Developers Refresh Their Attack Tools
Robert Lemos, Contributing WriterNews
Cisco analyzes the latest version of the LokiBot malware for stealing credentials, finding that its developers have added more misdirection and anti-analysis features.
By Robert Lemos Contributing Writer, 1/8/2021
Comment0 comments  |  Read  |  Post a Comment
SolarWinds Hires Chris Krebs and Alex Stamos for Breach Recovery
Dark Reading Staff, Quick Hits
The former US cybersecurity official and former Facebook security chief will help SolarWinds respond to its recent attack and improve security.
By Dark Reading Staff , 1/8/2021
Comment1 Comment  |  Read  |  Post a Comment
Cobalt Strike & Metasploit Tools Were Attacker Favorites in 2020
Kelly Sheridan, Staff Editor, Dark ReadingNews
Research reveals APT groups and cybercriminals employ these offensive security tools as often as red teams.
By Kelly Sheridan Staff Editor, Dark Reading, 1/7/2021
Comment0 comments  |  Read  |  Post a Comment
FireEye's Mandia: 'Severity-Zero Alert' Led to Discovery of SolarWinds Attack
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
CEO Kevin Mandia shared some details on how his company rooted out the major cyberattack campaign affecting US government and corporate networks.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/7/2021
Comment0 comments  |  Read  |  Post a Comment
Ransomware Victims' Data Published via DDoSecrets
Dark Reading Staff, Quick Hits
Activists behind Distributed Denial of Secrets has shared 1TB of data pulled from Dark Web sites where it was shared by ransomware attackers.
By Dark Reading Staff , 1/7/2021
Comment0 comments  |  Read  |  Post a Comment
Nissan Source Code Leaked via Misconfigured Git Server
Dark Reading Staff, Quick Hits
Leaked information includes source code of Nissan mobile apps, diagnostics tool, and market research tools and data, among other assets.
By Dark Reading Staff , 1/6/2021
Comment0 comments  |  Read  |  Post a Comment
DoJ's Microsoft 365 Email Accounts Compromised in SolarWinds Attacks
Dark Reading Staff, Quick Hits
Three percent of email accounts were breached, the Department of Justice reports.
By Dark Reading Staff , 1/6/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162
PUBLISHED: 2021-01-15
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...
CVE-2021-21245
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to u...
CVE-2021-21246
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/` endpoint there are no security checks enforced so it is possible to retrieve ar...