42
30
42
Apple warned hundreds of users of mercenary spyware attacks
Apple sent threat notifications to users in 110 countries warning of targeted mercenary spyware attacks and recommending Lockdown Mode.
Apple sent a new round of threat notifications warning users in 110 countries they may have been individually targeted by mercenary spyware, adding to alerts issued in more than 150 countries since the program began in 2021. The company says such attacks are vastly more sophisticated than criminal activity, cost millions of dollars, and typically target journalists, activists, politicians, diplomats, and lawyers. Apple recommends verifying notices directly at account.apple.com, enabling Lockdown Mode, keeping devices updated, and seeking expert help such as Access Now's Digital Security Helpline. Citizen Lab researchers note the alerts can reveal that entire communities are under targeted surveillance.
58
42
60
30
42
55
55
30
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists
FBI, NCSC, and AIVD detail Iran MOIS spyware CHOSEN BRICK/HEAVYGRAM, Telegram-controlled Windows malware spying on dissidents since 2023.
A September 15 joint advisory from the FBI, UK NCSC, and Dutch AIVD attributes the Windows spyware HEAVYGRAM (NCSC name CHOSEN BRICK) to Iran's Ministry of Intelligence and Security, with the campaign dating to autumn 2023 and targeting dissidents, journalists, and activists in the UK, US, Netherlands, and worldwide. Delivered via messages impersonating known contacts or tech support, the malware assigns each victim a dedicated Telegram bot for command-and-control and exfiltration, and can take screenshots, record microphone audio, steal Telegram/WhatsApp data, saved passwords, and emails, download more malware, and wipe the computer. Persistence uses a registry Run key (SMQDService or winappx) plus Microsoft Defender exclusions, with stolen data exiting via Telegram and cloud storage services like Vultr and Storj. The US Justice Department seized four pro-Iranian leak sites in March that had published stolen victim data.
65
42
55
30
30
30
30
60
42
60
35
60
42
60
47
30
30
55
55
60
60
42
30
30
30
30
60
30
60