In today’s cybersecurity news…
Apple blocks ByteDance Chinese apps
These technical restrictions will stop iOS users in the U.S. from downloading other apps from TikTok parent company ByteDance. This procedure actually started in January, in which U.S. based iPhone users with Chinese App Store accounts began reporting obstacles when trying to download apps developed by ByteDance. WIRED has confirmed that “even with a valid Chinese App Store account, downloading or updating a ByteDance-owned Chinese app is blocked on Apple devices located in the United States.” Neither Apple nor ByteDance nor the new entity controlling TikTok’s U.S. operations, TikTok USDS Joint Venture responded to WIRED’s request for comment.
(Wired)
Google says 90 zero-days were exploited in attacks last year
A report from the Google Threat Intelligence Group (GTIG) says that it tracked these 90 zero-day exploited vulnerabilities throughout 2025, and almost half of them were in enterprise software and appliances. This is 15% more than 2024, but lower than the record 100 zero days tracked in 2023. Forty-seven of the vulnerabilities targeted end-user platforms, and 43 targeted enterprise products. “The most targeted enterprise systems were security appliances, networking infrastructure, VPNs, and virtualization platforms, as these provide privileged network access and often lack EDR monitoring.”
Iran intelligence backdoored U.S. bank, airport, software outfit networks
According to threat hunting teams from Symantec and Carbon Black, an Iranian cyber crew believed to be part of the Iranian Ministry of Intelligence and Security (MOIS) has been embedded in the networks of multiple U.S. companies, including a bank, software firm, and airport, and non-governmental organizations in the U.S. and Canada, since the beginning of February. The activity which has ramped up in recent days, is connected to MuddyWater which has been carrying out cyber campaigns on behalf of the Iranian intel agency since approximately 2018.
CISA nominee Plankey exits Coast Guard position
Following up on a story we covered last July, Sean Plankey, the Department of Homeland Security senior adviser and presidential nominee to lead CISA, was “escorted out of the U.S. Coast Guard headquarters late Monday and had his access badge removed, according to sources familiar with the matter.” He has apparently left his role at DHS, though “circumstances behind the sudden move remain unclear.” This follows a hold that was placed on his nomination late last year. Despite this, a White House official has reaffirmed that Plankey is the nominee to lead CISA, despite his removal, and referred questions about his removal from the Coast Guard position to DHS.
(CBS News)
Huge thanks to our sponsor, Adaptive Security
Check Point announces Secure AI Advisory Service for enterprise adoption
This new advisory service aims to address the challenges of regulatory scrutiny and operational risks “as AI systems expand across hybrid networks, cloud environments, and digital workspaces.” Named the Secure AI Advisory Service, it is delivered through Check Point’s Cyber Resilience and Response unit, known as CPR Act. Check Point says the new service “integrates governance into the broader security lifecycle, linking intelligence, readiness, detection, and response capabilities” in alignment with frameworks such as the EU AI Act, GDPR, ISO 42001, and the NIST AI Risk Management Framework.
Hundreds of Iranian hacking attempts hit surveillance cameras
According to researchers at Check Point, “multiple Iranian hacking crews have been targeting internet-connected surveillance cameras across Israel and other Middle Eastern countries” since the start of the war there on February 28. These have been described as attempts to exploit a handful of bugs in IP cameras made by two manufacturers, Hikvision and Dahua. The countries targeted include Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus, and Lebanon.
HHS updates free risk tool to help hospitals assess cybersecurity exposure
The Department of Health and Human Services unveiled the tool yesterday. It is intended to help health care facilities assess their cybersecurity risks, “elevating the emphasis on those threats to the kind produced by weather conditions and other dangers.” Developed through the Administration for Strategic Preparedness and Response (ASPR), the solution “comes in the form of an update to the Risk Identification and Site Criticality (RISC) 2.0 Toolkit to include a specific focus on cybersecurity. The module “walks users through a series of questions and measures them against the influential NIST Cybersecurity Framework 2.0, as well as HHS’s own voluntary cybersecurity performance goals.”
Phobos operator pleads guilty
Following up on a story we covered mid-February, 43-year-old Russian national Evgenii Ptitsyn “has pleaded guilty in a U.S. court to charges stemming from his role in the Phobos ransomware operation.” He was arrested in South Korea in June 2024. He now faces up to 20 years in prison. Sentencing is scheduled for July 15. “Ptitsyn appears to have been part of the administration team, which offered malware and infrastructure that affiliates could use to target victims and obtain ransom payments.”