ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “nfl”

2 stories in the last 24h

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI industry 3Data breach 2Exploit / PoC 2Threat actor 2Malware 1Vulnerability 1Advisory 1
SeverityAllcritical 2high 2medium 5low 0info 3

Chinese hackers use SparroWocky malware in govt espionage attacks

ESET reports China-linked FamousSparrow deployed a new modular backdoor, SparroWocky, in year-long espionage attacks on Latin American government organizations.

ESET researchers observed FamousSparrow using SparroWocky, a modular C++ backdoor replacing the earlier SparrowDoor tool, against government targets in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. Deployed via DLL side-loading with an RC4-encrypted payload mapped in memory, it captures screenshots, acts as a TCP proxy, and hooks CreateThread so malicious threads appear as AnimateWindow. Persistence uses a ProcAuditManager Windows service or SnapCart registry key; ESET tracked at least 18 C2 addresses and published IoCs.

BleepingComputer · 1h agoThreat actor in the wild

Iranian hackers use CHOSEN BRICK Windows malware to spy on targets

Iranian state-linked hackers use CHOSEN BRICK Windows malware, spread via Telegram and WhatsApp social engineering, to spy on dissidents and journalists worldwide.

US, UK, and Dutch cyber agencies with the FBI issued a joint advisory on Iranian state-linked hackers deploying a Windows malware strain called CHOSEN BRICK against dissidents, activists, and journalists, primarily in the US, UK, and Netherlands. Attacks begin with messages on WhatsApp or Telegram impersonating trusted contacts or technical support, tricking victims into running malicious files disguised as apps such as Pictory, RunwayML, Norton Antivirus, Telegram, and KeePass. The malware persists via Registry Run keys, adds Microsoft Defender exclusions, and uses a per-victim Telegram bot for command-and-control while stealing email, Telegram and WhatsApp data, screenshots, and audio. Stolen data is exfiltrated via Telegram or cloud services like VultrObjects and StorjShare, and sometimes appears on pro-Iranian leak sites, increasing physical risk for dissidents abroad.

BleepingComputerupdated · 2h agofirst · 13h agoThreat actor in the wild 7 sources