Search: “ACT”

2 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI safety & security 24 Policy & legal 12 Industry 11 AI industry 9 AI policy 9 Malware 8 Advisory 7 AI tools & infra 6 Research 6 Threat actor 6 Vulnerability 5 AI research 5 Data breach 5 Phishing & fraud 4

SeverityAll critical 1 high 16 medium 25 low 1 info 80

FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor

China-aligned FamousSparrow deployed its new SparroWocky backdoor against Latin American governments since August 2025, initially accessing networks via exploited Exchange servers.

ESET attributes the SparroWocky campaign to FamousSparrow with high confidence, partly because early infections were delivered via the group's exclusive SparrowDoor implant. Since at least August 2025, the modular C++ backdoor was found at government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, with 90% of the group's mid-2025 telemetry targets in the region. SparroWocky supports command execution, file execution, TCP proxying, host reconnaissance, screenshot capture, RC4-encrypted TLS exfiltration, and Cobalt Strike BOF loading, using runtime patching and call-stack forging for evasion. ESET links the regional focus to China's response to renewed US interest in Latin America and notes a possible, unclear link to Trend Micro's Earth Estries.

Infosecurity Magazineupdated Sep 17, 19:15 UTC · 18h agofirst Sep 17, 15:00 UTC · 23h agoThreat actor in the wild 9 sources CVE-2021-26855

NCSC and Allies Warn of Iranian Spyware Campaign

NCSC, FBI and AIVD warn Iranian-backed actors deliver Chosen Brick spyware to regime critics via social engineering; stolen data has surfaced on pro-Iranian leak sites.

NCSC, the FBI and the Netherlands' AIVD published a joint advisory warning that a Tehran-backed campaign, active since at least 2025, targets dissidents, activists and journalists with Chosen Brick spyware. The malware persists via Windows registry keys, adds Microsoft Defender exclusions, uses Telegram for C2, and captures screens, audio, emails and Telegram or WhatsApp messages. Stolen data has surfaced on pro-Iranian leak sites in some cases, raising risks to victims' personal safety.

Infosecurity Magazineupdated Sep 17, 14:03 UTC · 1d agofirst Sep 16, 08:25 UTC · 2d agoThreat actor in the wild 10 sources