We can try to bridge the cybersecurity skills gap, but that doesn’t necessarily mean more jobs for defenders

Talos reports a multi-country active campaign dubbed “DragonRank” that compromises Windows IIS servers to install BadIIS and PlugX malware for SEO manipulation, credential harvesting, and distribution of scam websites; Talos released Snort rules and ClamAV signatures and published multiple malware hashes as IOCs. The newsletter also highlights other notable security items: RAMBO research showing possible RAM-based exfiltration from air-gapped systems, continued evasive activity by commercial spyware vendors (Intellexa/NSO), and formal attribution of disruptive cyber attacks against Ukraine to GRU Unit 29155.