The Register-Security

June 14, 2025

"Microsoft slows Windows 11 24H2 Patch Tuesday due to "a compatibility issue.'"

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents. Accessed on 15 June 2025, 0122 UTC.

Content and Source: "The Register-Security."

Email subscription via https://feedly.com.

https://feedly.com/i/subscription/feed%2Fhttp%3A%2F%2Fwww.theregister.co.uk%2Fsecurity%2Fheadlines.atom

Please check email link or scroll down to read your selections. Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

PatchTuesday

•

by Richard Speed / 3d

On your marks, get set... bork! updated Microsoft set a new record with June's security update for the time between release and an admission of borkage.…

DeepSeek installer or just malware in disguise? Click around and find out

IoC > 2 URLs

•

by Jessica Lyons / 3d

•

3 TTPs

•

BrowserVenom malware targets DeepSeek users

'BrowserVenom' is pure poison Suspected cybercriminals have created a fake installer for Chinese AI model DeepSeek-R1 and loaded it with previously unknown malware called "BrowserVenom".…

Apple fixes zero-click exploit underpinning Paragon spyware attacks

2 TTPs

•

by Connor Jones / 1d

•

CVE-2025-43200

Zero-day potentially tied to around 100 suspected infections in 2025 and a spyware scandal on the continent Apple has updated its iOS/iPadOS 18.3.1 documentation, confirming it introduced fixes for the zero-click vulnerability used to infect journalists with Paragon's Graphite spyware.…

Yesterday

Cyber weapons in the Israel-Iran conflict may hit the US

by Jessica Lyons / 1d

With Tehran’s military weakened, digital retaliation likely, experts tell The Reg The current Israel–Iran military conflict is taking place in the era of hybrid war, where cyberattacks amplify and assist missiles and troops, and is being waged between two countries with very capable destructive cyber weapons.…

Do you trust Xi with your 'private' browsing data? Apple, Google stores still offer China-based VPNs, report says

VPNs may expose data to China

•

by Jessica Lyons / 1d

Some trace back to an outfit under US export controls for alleged PLA links Both Apple's and Google's online stores offer free virtual private network (VPN) apps owned by Chinese companies, according to researchers at the Tech Transparency Project, and they don't make this fact readily known to people downloading the apps.…

Wanted: Junior cybersecurity staff with 10 years' experience and a PhD

by Connor Jones / 1d

Infosec employers demanding too much from early-career recruits, says ISC2 Cybersecurity hiring managers need a reality check when it comes to hiring junior staff, with job adverts littered with unfair expectations that are hampering recruitment efforts, says industry training and cert issuer ISC2.…

Jun 12, 2025

Slapped wrists for Financial Conduct Authority staff who emailed work data home

by Connor Jones / 1d

It was one of the offenders' final warning Four staffers at the UK's Financial Conduct Authority (FCA) were let off with warnings over separate cases involving the transmission of regulator data to their personal email accounts.…

Ransomware scum disrupted utility services with SimpleHelp attacks

3 TTPs

•

by Jessica Lyons / 2d

Good news: The vendor patched the flaw in January. Bad news: Not everyone got the memo Ransomware criminals infected a utility billing software providers' customers, and in some cases disrupted services, after exploiting unpatched versions of SimpleHelp’s remote monitoring and management (RMM) tool, according to a Thursday CISA alert.…

'Major compromise' at NHS temping arm exposed gaping security holes

15 TTPs

•

by Connor Jones / 2d

Incident responders suggested sweeping improvements following Active Directory database heist Exclusive Cybercriminals broke into systems belonging to the UK's NHS Professionals body in May 2024, stealing its Active Directory database, but the healthcare organization never publicly disclosed it, The Register can reveal.…

Jun 11, 2025

Hire me! To drop malware on your computer

IoC > 2 domains, 4 hashes, 9 URLs, and 2 IPs

•

by Jessica Lyons / 3d

•

14 TTPs

•

FIN6 delivers More_eggs via AWS

FIN6 moves from point-of-sale compromise to phishing recruiters In a scam that flips the script on fake IT worker schemes, cybercriminals posing as job seekers on LinkedIn and Indeed are targeting recruiters - a group hated only slightly less than digital crooks - with malware hosted on phony resume portfolio sites.…

Salesforce tags 5 CVEs after SaaS security probe uncovers misconfig risks

4 TTPs

•

by Connor Jones / 3d

The 16 other flagged issues are on customers, says CRM giant Salesforce has assigned five CVE identifiers following a security report that uncovered more than 20 configuration weaknesses, some of which exposed customers to unauthorized access and session hijacking.…

Asia dismantles 20,000 malicious domains in infostealer crackdown

Interpol dismantles 20000 malicious IPs

•

by Connor Jones / 3d

Interpol coordinates operation, nabs 32 across Vietnam, Sri Lanka, and Nauru Thirty-two people across Asia have been arrested over their suspected involvement with infostealer malware in the latest international collaboration against global cybercrime.…

Analysis to action: Operationalizing your threat intelligence

5 TTPs

•

by Joe Kaden, senior technical account manager, Prelude Security / 3d

Timing is everything in the war against ransomware thieves, says Prelude Security Partner content When a new security advisory drops or an alarming new ransomware campaign makes the news, the question from leadership inevitably follows: "Are we covered?"…

Jun 10, 2025

CISO who helped unmask Badbox warns: Version 3 is coming

by Jessica Lyons / 3d

The botnet’s still alive and evolving Badbox 2.0, the botnet that infected millions of smart TV boxes and connected devices before private security researchers and law enforcement partially disrupted its infrastructure, is readying for a third round of fraud and digital attacks, according to one of the threat hunters who uncovered the original scheme.…

Hawaii Cybersecurity Journal