Apple blocks ByteDance, Google's 90 zero-days, Iran backdoors U.S. organizations

0:00From the CISO series, it's Cybersecurity Headlines. These are the Cybersecurity Headlines for Friday. March the 6th, 2026. I'm Steve Prentice. Apple blocks bite-dance Chinese apps. These technical restrictions will stop iOS users in the US from downloading other apps from TikTok parent company bite-dance. This procedure actually started in January in which US-based iPhone users with Chinese app store accounts began reporting obstacles when trying to download apps developed by bite-dance. Wired has confirmed that, quote, even with a valid Chinese app store account, downloading or updating a bite-dance owned Chinese app is blocked on Apple devices located in the United States. End quotes. Neither Apple nor bite-dance nor the new entity controlling TikTok's US operations, TikTok USDS joint venture, responded to Wired's request for comment.

1:03Google says 90 zero days were exploited in attacks last year. A report from the Google Threat Intelligence Group says that it tracked these 90 zero-day exploited vulnerabilities throughout 2025 and almost half of them were in enterprise software and appliances. This is 15% more than 2024, but lower than the record of 100 zero days tracked in 2023. 47 of the vulnerabilities targeted end user platforms and 43 targeted enterprise products. The report says, quote, the most targeted enterprise systems were security appliances, network infrastructure, the VPNs and virtualization platforms as these provide privileged network access and often lack EDR monitoring, end quotes. Iran intelligence backdoored US bank, airport and software outfit networks. According to Threat Hunting Teams from semantic and carbon black, an Iranian cyber group believed to be part of the Iranian Ministry of Intelligence and Security

2:04has been embedded in the networks of multiple US companies including a bank, a software firm, an airport, and non-governmental organizations in the US and Canada since the beginning of February. The activity which has ramped up in recent days is connected to muddy water, which has been carrying out cyber campaigns on behalf of the Iranian intel agency since approximately 2018. CISA nominee Planky exits Coast Guard position. Following up on a story we covered last July, Sean Planky, the Department of Homeland Security Senior Advisor and Presidential nominee to lead CISA, was, quote, escorted out of the US Coast Guard headquarters late Monday and has had his access badge removed, according to sources familiar with the matter, end quote. He has apparently left his role at the DHS, though, quote, circumstances behind the sudden move remain unclear, end quote. This follows a hold that was placed on his nomination for CISA's leadership late last year,

3:05but despite this, a White House official has reaffirmed that Planky is the nominee to lead CISA despite his removal and referred questions about his removal from the Coast Guard position to DHS. Huge thanks to our sponsor, Adaptive Security. This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI-powered social engineering. Security training fails when it's generic. Adaptive's platform personalizes training and runs deep fake simulations across email, SMS, voice, and video. And with Adaptive's AI content creator, drop in a breaking threat or compliance doc and instantly turn it into interactive multilingual training. No designers and no delays. Learn more at AdaptiveSecurity.com, those are the two words AdaptiveSecurityTogether.com. Checkpoint announces Secure AI Advisory Service for Enterprise

4:08Adoption. This new advisory service aims to address the challenges of regulatory scrutiny and operational risks as, quote, AI systems expand across hybrid networks, cloud environments, and digital workspaces end quote. Named the Secure AI Advisory Service, it is delivered through Checkpoint's Cyberresilience and Response Unit known as CPR Act. Checkpoint says the new service, quote, integrates governance into the broader security life cycle, linking intelligence, readiness, detection, and response capabilities end quote, in alignment with frameworks such as the EU AI Act, GDPR, ISO 42,001, and the NIST AI Risk Management Framework. Hundreds of Iranian hacking attempts hit surveillance cameras. Another story from Checkpoint, according to researchers from that company, quote, multiple Iranian hacking crews have been targeting internet-connected surveillance cameras across Israel and other Middle Eastern countries, end quote, since the start of the war there on February 28th.

5:10These have been described as attempts to exploit a handful of bugs in IP cameras made by two manufacturers, Hick Vision and Dawah. The countries targeted include Israel, Qatar, Bahrain, Q8, the United Arab Emirates, Cyprus, and Lebanon. HHS updates free risk tools to help hospitals assess cybersecurity exposure. The Department of Health and Human Services unveiled the tool yesterday. It is intended to help health care facilities assess their cybersecurity risks, quote, elevating the emphasis on those threats to the kind produced by weather conditions and other dangers end quote. Developed through the administration for strategic preparedness and response, the solution quote comes in the form of an update to the risk identification and site criticality toolkit that is risk 2.0 to include a specific focus on cybersecurity. The model walks users through a series of questions and measures them against the influential NIST Cybersecurity Framework 2.0,

6:10as well as the HHS's own voluntary cyber security performance goals. Phobos operator pleads guilty. Following up on a story we covered mid-February, 43-year-old Russian National Evegeny Ptsitskyn has pleaded guilty in a US court to charges stemming from his role in the Phobos ransom or operation. He was arrested in South Korea in June 2024 and now faces up to 20 years in prison. Sentencing is scheduled for July 15. Ptsitskyn appears to have been part of the administration team which offered malware and infrastructure that affiliates could use to target victims and obtain ransom payments. End quote. Remember to subscribe to the CISO series YouTube channel. We have original shorts posted every day, plus demos, interviews, previews of upcoming events and clips from our favorite conversations. Just search for CISO series on YouTube. And if you have some thoughts on the news from today or about this show in general,

7:11please be sure to reach out to us at feedback at CISOSeries.com. We would love to hear from you. I'm Steve Prentice, reporting for the CISO series. Cybersecurity headlines are available every weekday. Head to CISOSeries.com for the full stories behind the headlines.