Hunters International, one of the most active ransomware operations of the past two years, said on 3 July that it is shutting down and will provide free decryption software to all organisations it previously extorted. In a statement on its dark-web site the group asked victims to request keys through its portal, saying the move aims to let companies "recover your encrypted data without the burden of paying ransoms."

Read more

US cyber-security authorities issued a joint advisory on 30 June warning that hackers aligned with Iran’s Islamic Revolutionary Guard Corps could mount near-term attacks on American networks. The fact sheet—released by CISA, the FBI, the NSA and the Defense Department’s Cyber Crime Center—says defense contractors, especially those working with Israeli firms, as well as operators of water, energy and other critical infrastructure, should prepare for distributed-denial-of-service, ransomware and data-theft campaigns.

Read more

Japan has established the National Cybersecurity Office as the central command for active cyber defense, marking a key development in the country's cybersecurity framework. The office was inaugurated on July 1, 2025, coinciding with the partial enforcement of the Active Cyber Defense Act. The government held the first meeting of the reorganized Cybersecurity Strategy Headquarters, led by the Prime Minister, at the Prime Minister's Official Residence. This new structure aims to enhance coordination between the public and private sectors and to formulate a new cybersecurity strategy by the end of the year.

The initiative reflects Japan's emphasis on proactive measures to counter cyber threats, with calls for increased corporate involvement. The U.S. Embassy in Japan acknowledged the establishment as a major milestone in protecting cyberspace, highlighting the importance of cybersecurity as a frontline defense in the 21st century.

German Interior Minister Alexander Dobrindt said Berlin will establish a joint cyber-research centre with Israel and deepen intelligence and security collaboration, outlining the plan during a visit to Israel on 29 June. The project, dubbed a “Cyber Dome,” is part of a five-point strategy to strengthen Germany’s cyber-defence capabilities as it modernises its military posture against threats from Russia and China.

Read more

Dozens of anonymous social media accounts advocating for Scottish independence abruptly ceased activity on June 12-13, coinciding with a major Israeli airstrike campaign targeting Iranian military and cyber infrastructure. British media, including the UK Defence Journal and The Telegraph, reported that these accounts, which had collectively posted over 250,000 pro-independence messages, were likely part of an Iranian influence operation. The Israeli strikes caused significant internet disruptions in Iran, leading to the sudden silence of these accounts on platforms such as X (formerly Twitter). Analysts suggest that Iran’s cyber program was using these accounts to push Scottish independence as part of a broader strategy to undermine Britain.

British health officials have confirmed that a ransomware cyberattack on NHS blood services and diagnostic provider Synnovis in June 2024 contributed to the death of a patient at a London hospital. The attack, attributed to the Russian ransomware group Qilin, disrupted pathology services across NHS hospitals and GP surgeries in southeast London. This breach caused delays in critical medical procedures, including over 1,000 cancer treatment postponements and affected approximately 2,000 other patients. The incident marks one of the first official confirmations linking a patient fatality directly to a cyberattack on healthcare services in the UK.

British health officials have confirmed that a ransomware cyberattack on NHS blood services and diagnostic provider Synnovis in London contributed to the death of a patient. The attack, carried out by the Russian ransomware group Qilin on June 3, 2024, disrupted pathology services across NHS hospitals and GP surgeries in southeast London. The breach caused delays in over 1,000 cancer treatments and affected approximately 2,000 other medical procedures. This incident marks one of the first official confirmations linking a patient fatality directly to hacking activity within the UK healthcare system.

Iran said it will fully reconnect to the global internet at 8:00 p.m. local time on Saturday, 21 June, after nationwide disruptions imposed during its recent conflict with Israel. Communications Minister Sattar Hashemi told state media that cyberattacks responsible for part of the outage had been repelled and that links to the international network would be reinstated in all provinces.

Connectivity had been curtailed across mobile, fixed-line and data networks for roughly 12 days while Iran exchanged fire with Israel. Officials justified the blackout on security grounds, saying temporary restrictions were needed to mitigate cyber threats and prevent the spread of sensitive battlefield information.

Read more

The United States is bracing for potential Iranian reprisals after weekend air-strikes destroyed three nuclear facilities in Iran. Air Force Gen. Dan Caine, chairman of the Joint Chiefs of Staff, said U.S. forces are “on high alert” and “fully postured to respond to any Iranian retaliation or proxy attacks,” calling such action “an incredibly poor choice.” U.S. Central Command chief Gen. Michael Kurilla has raised force-protection levels for American personnel in Iraq, Syria and across the Gulf.

Read more

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Linux kernel vulnerability (CVE-2023-0386) to its Known Exploited Vulnerabilities catalog, with agencies required to address the flaw by July 8. This vulnerability allows attackers to gain root access through a simple exploit and is actively being exploited. Additionally, two newly discovered chained Linux flaws (CVE-2025-6018 and CVE-2025-6019) enable local users to escalate privileges to root within seconds on most major Linux distributions, which are vulnerable by default.

In related cybersecurity developments, Russia-backed APT28 hackers have been using Signal chat to distribute malware-laced Word documents targeting Ukrainian systems. These attacks involve the deployment of BEARDSHELL and COVENANT malware, with one component using an image file to initiate an in-memory attack chain designed to evade detection. The malware campaign highlights ongoing cyber threats linked to geopolitical conflicts in Eastern Europe.

Kenya has positioned itself as a regional leader in data privacy protection, supported by a robust legal framework. Key legislation includes the Computer Misuse and Cybercrimes Act of 2018 and the Data Protection Act, which collectively regulate cybersecurity and data privacy. All data handlers in Kenya are legally required to register with the Office of the Data Protection Commissioner (ODPC). The government has undertaken efforts to raise public awareness about data protection and privacy rights, emphasizing the importance of understanding what personal data organizations hold and their purposes. Experts highlight the necessity of practicing good cybersecurity hygiene and caution individuals about the long-term implications of their online activities. In the context of emerging technologies such as artificial intelligence, data compliance and privacy remain critical issues, with specialists distinguishing between data privacy and data protection and advising caution in sharing personal information online.

Iranian state-aligned media outlets warned on 18 June that text messages purporting to come from the office of Supreme Leader Ali Khamenei contain malicious links designed to infect mobile phones. The news site Tabnak reported that unsuspecting users nationwide had begun receiving the fraudulent SMS, while the security-focused Nour News agency urged the public to avoid opening any links sent by text, even if they appear to originate from officials.

The judiciary-run Mizan News Agency issued a similar alert, underscoring that the link installs malware capable of compromising device data. Authorities did not disclose the scale of the campaign or attribute it to a specific group, but said investigations are under way and advised recipients to delete the messages immediately.

Iran’s Cyber Security Command has prohibited all government officials and their security teams from using any devices connected to public communication or telecommunications networks, state-run Fars News Agency reported on Tuesday, June 17.

The directive, described as immediate, covers smartphones, laptops, smartwatches and other internet-enabled equipment. Authorities said the measure aims to strengthen information security amid growing concerns about cyber-espionage and potential data leaks.

The command also urged the public to minimize reliance on smart devices and adopt additional protective measures. Unconfirmed local reports cited widespread disruptions at ATMs and point-of-sale terminals, although officials have not linked those outages to the new restrictions.

Nearly half of retail cryptocurrency investors see themselves, rather than external hackers, as the greatest threat to their digital assets, according to a new survey by U.S. exchange Kraken. Polling 800 American crypto holders, the study found 48% were more concerned about losing funds through personal error—such as mismanaging private keys—than via a coordinated cyberattack.

The findings echo a separate study released by cybersecurity firm CSC, which reported that an overwhelming majority of Chief Information Security Officers anticipate a significant increase in cyberattacks over the next three years. Together, the surveys highlight a dual challenge for the security sector: rising external threats and persistent vulnerabilities created by user behavior.

U.S. Customs and Border Protection issued a national alert warning that scammers are posing as CBP officers and Border Patrol agents, demanding immediate payments by phone. The agency stressed it never solicits money over the phone and advised recipients to hang up immediately.

The warning coincides with a surge in so-called smishing schemes that distribute bogus texts about unpaid traffic tickets or Department of Motor Vehicles violations. Authorities in Arizona, Ohio, Michigan, Illinois and the Washington, D.C., region report widespread messages that use real officials’ names or fictitious agencies to coax victims into clicking malicious links or transferring funds.

Read more

Texas-based cybersecurity firm Securonix has acquired ThreatQuotient, a threat intelligence startup that assists companies in analyzing threat intelligence more efficiently. ThreatQuotient had previously raised approximately $170 million in funding. This acquisition aims to enhance Securonix's capabilities in threat detection, investigation, and response, positioning it to deliver one of the industry's broadest and deepest security platforms. Separately, CybaVerse has acquired SecureAck to expand its next-generation security operations platform targeted at small and medium-sized enterprises (SMEs) and managed service providers (MSPs). Additionally, KnowBe4 has received multiple 2025 Top Rated Awards from TrustRadius, and Keeper Security has been named the overall leader in the GigaOm Radar Report for enterprise password management. The European Cybersecurity Blogger Awards 2025 also recognized both industry veterans and new talent in the cybersecurity field.

A new malware threat has emerged targeting users attempting to install the DeepSeek application. Reports indicate that a fake DeepSeek website is distributing a malicious executable file disguised as the popular app. This malware has notably impacted users in India, raising concerns about the security of the installation process. Cybersecurity experts and information security platforms have warned users against downloading DeepSeek from unofficial sources, highlighting the risks of infection through these fraudulent installers.

Cybersecurity investigators have identified a highly unusual software crash affecting a limited number of smartphones used by individuals in government, politics, technology, and journalism sectors. The crashes, which began in late 2024 and continued into 2025, have raised concerns about a sophisticated cyberattack. This attack potentially allowed hackers to infiltrate smartphones without any user interaction, indicating a significant breach in mobile security. The incident has triggered heightened alerts regarding cybersecurity threats in the United States, with some reports suggesting involvement of Chinese hackers and user errors contributing to the vulnerability.

Cybersecurity investigators have identified a mobile security crisis involving a series of unusual software crashes affecting smartphones used by individuals in government, politics, technology, and journalism. The issue, which began in late 2024, has been linked to Chinese hackers exploiting vulnerabilities alongside user security lapses. Experts have warned that these combined threats are compromising smartphone security, particularly in sensitive sectors. Additionally, concerns have been raised about poor security practices at cryptocurrency events, including unlocked phones, suspicious QR codes, and risky Wi-Fi usage. Kraken's Chief Security Officer Nick Percoco advised the use of burner wallets and heightened vigilance to mitigate risks.

The FBI has reported a decrease in active shooter incidents in the United States, with 24 cases recorded in 2024, half the number reported in 2023. Texas led the nation with the highest number of active shooter incidents last year. The FBI also highlighted concerns about an online group, originating from a Texas teenager, that is targeting children nationwide, with over 250 active cases linked to the '764' network across its 55 U.S. field offices. In addition, the FBI warned about cybercriminals exploiting internet-connected home devices such as TV streaming devices and digital picture frames to gain unauthorized access and conduct criminal activities. The agency emphasized the importance of public cooperation in reporting crimes to enhance community safety and improve responses to cyber threats and violent crime.

Hunters International, one of the most active ransomware operations of the past two years, said on 3 July that it is shutting down and will provide free decryption software to all organisations it previously extorted. In a statement on its dark-web site the group asked victims to request keys through its portal, saying the move aims to let companies "recover your encrypted data without the burden of paying ransoms."

Read more

US cyber-security authorities issued a joint advisory on 30 June warning that hackers aligned with Iran’s Islamic Revolutionary Guard Corps could mount near-term attacks on American networks. The fact sheet—released by CISA, the FBI, the NSA and the Defense Department’s Cyber Crime Center—says defense contractors, especially those working with Israeli firms, as well as operators of water, energy and other critical infrastructure, should prepare for distributed-denial-of-service, ransomware and data-theft campaigns.

Read more

Japan has established the National Cybersecurity Office as the central command for active cyber defense, marking a key development in the country's cybersecurity framework. The office was inaugurated on July 1, 2025, coinciding with the partial enforcement of the Active Cyber Defense Act. The government held the first meeting of the reorganized Cybersecurity Strategy Headquarters, led by the Prime Minister, at the Prime Minister's Official Residence. This new structure aims to enhance coordination between the public and private sectors and to formulate a new cybersecurity strategy by the end of the year.

The initiative reflects Japan's emphasis on proactive measures to counter cyber threats, with calls for increased corporate involvement. The U.S. Embassy in Japan acknowledged the establishment as a major milestone in protecting cyberspace, highlighting the importance of cybersecurity as a frontline defense in the 21st century.

German Interior Minister Alexander Dobrindt said Berlin will establish a joint cyber-research centre with Israel and deepen intelligence and security collaboration, outlining the plan during a visit to Israel on 29 June. The project, dubbed a “Cyber Dome,” is part of a five-point strategy to strengthen Germany’s cyber-defence capabilities as it modernises its military posture against threats from Russia and China.

Read more

Dozens of anonymous social media accounts advocating for Scottish independence abruptly ceased activity on June 12-13, coinciding with a major Israeli airstrike campaign targeting Iranian military and cyber infrastructure. British media, including the UK Defence Journal and The Telegraph, reported that these accounts, which had collectively posted over 250,000 pro-independence messages, were likely part of an Iranian influence operation. The Israeli strikes caused significant internet disruptions in Iran, leading to the sudden silence of these accounts on platforms such as X (formerly Twitter). Analysts suggest that Iran’s cyber program was using these accounts to push Scottish independence as part of a broader strategy to undermine Britain.

British health officials have confirmed that a ransomware cyberattack on NHS blood services and diagnostic provider Synnovis in June 2024 contributed to the death of a patient at a London hospital. The attack, attributed to the Russian ransomware group Qilin, disrupted pathology services across NHS hospitals and GP surgeries in southeast London. This breach caused delays in critical medical procedures, including over 1,000 cancer treatment postponements and affected approximately 2,000 other patients. The incident marks one of the first official confirmations linking a patient fatality directly to a cyberattack on healthcare services in the UK.

British health officials have confirmed that a ransomware cyberattack on NHS blood services and diagnostic provider Synnovis in London contributed to the death of a patient. The attack, carried out by the Russian ransomware group Qilin on June 3, 2024, disrupted pathology services across NHS hospitals and GP surgeries in southeast London. The breach caused delays in over 1,000 cancer treatments and affected approximately 2,000 other medical procedures. This incident marks one of the first official confirmations linking a patient fatality directly to hacking activity within the UK healthcare system.

Iran said it will fully reconnect to the global internet at 8:00 p.m. local time on Saturday, 21 June, after nationwide disruptions imposed during its recent conflict with Israel. Communications Minister Sattar Hashemi told state media that cyberattacks responsible for part of the outage had been repelled and that links to the international network would be reinstated in all provinces.

Connectivity had been curtailed across mobile, fixed-line and data networks for roughly 12 days while Iran exchanged fire with Israel. Officials justified the blackout on security grounds, saying temporary restrictions were needed to mitigate cyber threats and prevent the spread of sensitive battlefield information.

Read more

The United States is bracing for potential Iranian reprisals after weekend air-strikes destroyed three nuclear facilities in Iran. Air Force Gen. Dan Caine, chairman of the Joint Chiefs of Staff, said U.S. forces are “on high alert” and “fully postured to respond to any Iranian retaliation or proxy attacks,” calling such action “an incredibly poor choice.” U.S. Central Command chief Gen. Michael Kurilla has raised force-protection levels for American personnel in Iraq, Syria and across the Gulf.

Read more

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Linux kernel vulnerability (CVE-2023-0386) to its Known Exploited Vulnerabilities catalog, with agencies required to address the flaw by July 8. This vulnerability allows attackers to gain root access through a simple exploit and is actively being exploited. Additionally, two newly discovered chained Linux flaws (CVE-2025-6018 and CVE-2025-6019) enable local users to escalate privileges to root within seconds on most major Linux distributions, which are vulnerable by default.

In related cybersecurity developments, Russia-backed APT28 hackers have been using Signal chat to distribute malware-laced Word documents targeting Ukrainian systems. These attacks involve the deployment of BEARDSHELL and COVENANT malware, with one component using an image file to initiate an in-memory attack chain designed to evade detection. The malware campaign highlights ongoing cyber threats linked to geopolitical conflicts in Eastern Europe.

Kenya has positioned itself as a regional leader in data privacy protection, supported by a robust legal framework. Key legislation includes the Computer Misuse and Cybercrimes Act of 2018 and the Data Protection Act, which collectively regulate cybersecurity and data privacy. All data handlers in Kenya are legally required to register with the Office of the Data Protection Commissioner (ODPC). The government has undertaken efforts to raise public awareness about data protection and privacy rights, emphasizing the importance of understanding what personal data organizations hold and their purposes. Experts highlight the necessity of practicing good cybersecurity hygiene and caution individuals about the long-term implications of their online activities. In the context of emerging technologies such as artificial intelligence, data compliance and privacy remain critical issues, with specialists distinguishing between data privacy and data protection and advising caution in sharing personal information online.

Iranian state-aligned media outlets warned on 18 June that text messages purporting to come from the office of Supreme Leader Ali Khamenei contain malicious links designed to infect mobile phones. The news site Tabnak reported that unsuspecting users nationwide had begun receiving the fraudulent SMS, while the security-focused Nour News agency urged the public to avoid opening any links sent by text, even if they appear to originate from officials.

The judiciary-run Mizan News Agency issued a similar alert, underscoring that the link installs malware capable of compromising device data. Authorities did not disclose the scale of the campaign or attribute it to a specific group, but said investigations are under way and advised recipients to delete the messages immediately.

Iran’s Cyber Security Command has prohibited all government officials and their security teams from using any devices connected to public communication or telecommunications networks, state-run Fars News Agency reported on Tuesday, June 17.

The directive, described as immediate, covers smartphones, laptops, smartwatches and other internet-enabled equipment. Authorities said the measure aims to strengthen information security amid growing concerns about cyber-espionage and potential data leaks.

The command also urged the public to minimize reliance on smart devices and adopt additional protective measures. Unconfirmed local reports cited widespread disruptions at ATMs and point-of-sale terminals, although officials have not linked those outages to the new restrictions.

Nearly half of retail cryptocurrency investors see themselves, rather than external hackers, as the greatest threat to their digital assets, according to a new survey by U.S. exchange Kraken. Polling 800 American crypto holders, the study found 48% were more concerned about losing funds through personal error—such as mismanaging private keys—than via a coordinated cyberattack.

The findings echo a separate study released by cybersecurity firm CSC, which reported that an overwhelming majority of Chief Information Security Officers anticipate a significant increase in cyberattacks over the next three years. Together, the surveys highlight a dual challenge for the security sector: rising external threats and persistent vulnerabilities created by user behavior.

U.S. Customs and Border Protection issued a national alert warning that scammers are posing as CBP officers and Border Patrol agents, demanding immediate payments by phone. The agency stressed it never solicits money over the phone and advised recipients to hang up immediately.

The warning coincides with a surge in so-called smishing schemes that distribute bogus texts about unpaid traffic tickets or Department of Motor Vehicles violations. Authorities in Arizona, Ohio, Michigan, Illinois and the Washington, D.C., region report widespread messages that use real officials’ names or fictitious agencies to coax victims into clicking malicious links or transferring funds.

Read more

Texas-based cybersecurity firm Securonix has acquired ThreatQuotient, a threat intelligence startup that assists companies in analyzing threat intelligence more efficiently. ThreatQuotient had previously raised approximately $170 million in funding. This acquisition aims to enhance Securonix's capabilities in threat detection, investigation, and response, positioning it to deliver one of the industry's broadest and deepest security platforms. Separately, CybaVerse has acquired SecureAck to expand its next-generation security operations platform targeted at small and medium-sized enterprises (SMEs) and managed service providers (MSPs). Additionally, KnowBe4 has received multiple 2025 Top Rated Awards from TrustRadius, and Keeper Security has been named the overall leader in the GigaOm Radar Report for enterprise password management. The European Cybersecurity Blogger Awards 2025 also recognized both industry veterans and new talent in the cybersecurity field.

A new malware threat has emerged targeting users attempting to install the DeepSeek application. Reports indicate that a fake DeepSeek website is distributing a malicious executable file disguised as the popular app. This malware has notably impacted users in India, raising concerns about the security of the installation process. Cybersecurity experts and information security platforms have warned users against downloading DeepSeek from unofficial sources, highlighting the risks of infection through these fraudulent installers.

Cybersecurity investigators have identified a highly unusual software crash affecting a limited number of smartphones used by individuals in government, politics, technology, and journalism sectors. The crashes, which began in late 2024 and continued into 2025, have raised concerns about a sophisticated cyberattack. This attack potentially allowed hackers to infiltrate smartphones without any user interaction, indicating a significant breach in mobile security. The incident has triggered heightened alerts regarding cybersecurity threats in the United States, with some reports suggesting involvement of Chinese hackers and user errors contributing to the vulnerability.

Cybersecurity investigators have identified a mobile security crisis involving a series of unusual software crashes affecting smartphones used by individuals in government, politics, technology, and journalism. The issue, which began in late 2024, has been linked to Chinese hackers exploiting vulnerabilities alongside user security lapses. Experts have warned that these combined threats are compromising smartphone security, particularly in sensitive sectors. Additionally, concerns have been raised about poor security practices at cryptocurrency events, including unlocked phones, suspicious QR codes, and risky Wi-Fi usage. Kraken's Chief Security Officer Nick Percoco advised the use of burner wallets and heightened vigilance to mitigate risks.

The FBI has reported a decrease in active shooter incidents in the United States, with 24 cases recorded in 2024, half the number reported in 2023. Texas led the nation with the highest number of active shooter incidents last year. The FBI also highlighted concerns about an online group, originating from a Texas teenager, that is targeting children nationwide, with over 250 active cases linked to the '764' network across its 55 U.S. field offices. In addition, the FBI warned about cybercriminals exploiting internet-connected home devices such as TV streaming devices and digital picture frames to gain unauthorized access and conduct criminal activities. The agency emphasized the importance of public cooperation in reporting crimes to enhance community safety and improve responses to cyber threats and violent crime.