CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
CISA released three Industrial Control Systems (ICS) advisories on June 3, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.
CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations.
CSPM, DSPM, ASPM, SSPM, ESPM — the alphabet soup of Security Posture Management (SPM) tools promises visibility into risk. They map misconfigurations, surface exposure paths and highlight policy gaps. That can be useful. But let’s not confuse awareness with action.
They don’t block threats.SPMs detect, then delegate. A ticket. A Slack alert. An integration call. Protection is someone else’s problem.
To compensate, many posture tools claim to orchestrate security. They integrate with enforcement tools like DLP, CWPP, EDR and WAF. But wiring systems together doesn’t make the system secure.
Coordination ≠ ProtectionBecause posture is easier.
Yes, posture matters. But let’s not mistake issue tracking for actual security.
Security requires action — not just awareness.
False confidence, real consequencesThere’s an illusion of progress that posture tools can create. Dashboards look active. Tickets are assigned. Metrics suggest movement. But beneath that layer of perceived control, many organizations remain dangerously exposed.
In fact, {children}. Visibility alone isn’t moving the needle—security teams are still drowning in noise while real risks slip through. That's the difference between knowing something's wrong and doing something about it.
It’s why so many breaches still happen in environments that were “monitored.” The problem wasn’t a lack of alerts, it was the inability to respond in time.
And the results? Stolen IP. Leaked customer records. Compliance violations. Brand damage. Leadership churn.
The stakes aren’t theoretical. And yet too many teams are trapped in a cycle of detection without defense.
It’s time to rethink what protection meansThe right approach isn’t a patchwork of posture tools and point integrations. It’s a unified system — deep within a specific domain — that doesn’t just highlight problems but solves them in real time.
Whether you’re focused on data, identities or assets, true security means:
This isn’t a wishlist. This is what modern DLP — done right — can and should deliver.
Enter MIND: Posture & PreventionThat’s what MIND was built to do.
MIND combines the context-aware insights of DSPM (posture) with the automated enforcement of modern DLP (prevention).
We help security teams move beyond alert fatigue to actual control. Beyond passive monitoring to meaningful action. Beyond fractured tools to full-spectrum protection.
Our AI-powered classification engine understands your data in context—whether it’s source code, contracts, financial records, credentials, passwords, or PII. And it enforces your policies wherever data lives: SaaS and Gen AI apps, endpoints, on-premise file shares, emails and beyond.
We don’t just surface issues. We solve them.Security leaders are overburdened, not underinformed. With limited resources, increasing complexity and high expectations, they need solutions that deliver results, not just more dashboards.
Stop scanning. Start securing.
Mind What Matters.The post Posture ≠ Protection appeared first on Security Boulevard.
Cybercriminals have launched a sophisticated campaign targeting travelers through fake Booking.com websites that deploy AsyncRAT malware, according to recent security research. The threat actors redirect users from gaming sites, social media platforms, and sponsored advertisements to convincing replica booking sites designed to compromise visitor devices. This attack capitalizes on the fact that 40% of people […]
The post Beware of Fake Booking.com Sites That Infects Your Devices With AsyncRAT appeared first on Cyber Security News.
Infosecurity Europe 2025 is a cybersecurity event taking place from June 3 to 5 in London. Help Net Security is on-site and here’s a closer look at the conference. The featured vendors are: Okta, PlexTrac, ISC2, Insight, EasyDMARC, Defense.com, Tines, Darktrace, Torq, and Cyrebro.
The post Photos: Infosecurity Europe 2025 appeared first on Help Net Security.
A sophisticated cryptocurrency theft campaign has emerged on the npm package registry, targeting developers and cryptocurrency users through malicious packages designed to drain Ethereum and Binance Smart Chain wallets. The attack leverages heavily obfuscated JavaScript code to steal up to 85% of victims’ cryptocurrency holdings, demonstrating an evolving threat landscape where software supply chain attacks […]
The post Malicious NPM Packages Attacking Ethereum Wallets Using Obfuscated JavaScript appeared first on Cyber Security News.
In healthcare, every minute of downtime isn’t just a technical problem — it’s a patient safety risk.
CNN recently reported that Kettering Health, a major hospital network in Ohio, was hit by a ransomware attack. According to CNN, the Interlock ransomware group claimed responsibility, sending a chilling reminder that healthcare remains a prime target for this particular ransomware gang.
While technical details of the Kettering attack remain scarce, Interlock’s recent history — and the emergence of browser-based attack chains like ClickFix — should put every CISO on high alert. In fact, HHS released a sector-level alert on ClickFix, due to the severity of the attack and how focused attackers were in targeting healthcare organizations. Again, though it is not yet confirmed that this specific exploit was used at Kettering, Interlock has been linked to ClickFix attacks elsewhere.
While Kettering continues to focus on incident response, for those watching across the industry, what’s clear is the growing role of browser-based attacks in ransomware campaigns, and how, in healthcare environments, these kinds of attacks can be life-threatening.
Healthcare Remains a Top TargetRansomware actors continue to prioritize healthcare organizations as targets because of the high value placed on continuity of care. Timely access to records, imaging, and communication systems is essential for delivering treatment — so when those systems are disrupted, the operational impact is immediate.
Healthcare organizations are uniquely vulnerable to ransomware for several reasons:
The stakes are high: In 2024, 67% of healthcare organizations reported a ransomware attack, and research shows that patient care delays increase measurably during major incidents.
Recent examples of healthcare organizations disrupted because of a cyberattack include:
As more clinical and operational workflows move into SaaS apps and browser-delivered interfaces, the browser itself is becoming more relevant to healthcare security.
Understanding ClickFix and Browser-Based TacticsClickFix is a technique that relies on seemingly legitimate browser interactions — like fake CAPTCHAs or pop-up prompts — to trick users into activating malicious scripts. What makes this approach difficult to detect is that it relies heavily on the browser for clipboard manipulation, with no file download to trigger traditional file-based alerts or network signatures.
Here’s how a ClickFix attack could unfold in a healthcare organization:
SquareX first detailed this technique in 2024 to illustrate a broader challenge: many endpoint and network tools lack visibility into what happens in the browser — including browser extensions, clipboard activity, and in-browser scripting.
🧠 Read our full analysis, with step-by-step details, of the ClickFix attack →
Why Traditional Security Tools Miss Browser AttacksMost healthcare organizations rely on a familiar stack: Secure Web Gateways (SWG), Endpoint Detection & Response (EDR), and Data Loss Prevention (DLP). But these tools were not designed for the complexity of modern browsers.
What they miss:
Meanwhile, many clinical workflows — from EHRs to claims portals — now run in the browser. In fact, a 2024 survey of the healthcare technology market showed healthcare SaaS expecting to grow nearly 20% by 2028.
This is where Browser Detection & Response (BDR) can complement existing investments — by providing client-side visibility into user behavior and web application interactions that traditional controls can’t see.
Practical Next Steps for Healthcare Security TeamsThis is a good moment to reassess browser-layer visibility and controls. Here are some actions that security teams can take today:
The Kettering Health ransomware incident is yet another reminder of how persistent and creative today’s adversaries have become. While we don’t yet know exactly how the breach occurred, the involvement of a group known to use browser-based techniques raises thoughtful questions for defenders.
Rather than respond with alarm, this is an opportunity to ask:
Do we have the visibility we need at the browser layer?
Are we prepared to detect and respond to client-side threats that bypass legacy controls?
If your answer is no, that’s okay. Modernizing browser security doesn’t require a full overhaul — you may just need to layer in the right visibility where today’s users and workflows operate. Learn more in this Browser Detection and Response white paper.
Interlock and the Kettering Ransomware Attack: ClickFix’s Persistence was originally published in SquareX Labs on Medium, where people are continuing the conversation by highlighting and responding to this story.
The post Interlock and the Kettering Ransomware Attack: ClickFix’s Persistence appeared first on Security Boulevard.