60
Week in review: Windows kernel flaw patched, suspected Fortinet FortiWeb zero-day exploited
60
Iranian hackers use CHOSEN BRICK Windows malware to spy on targets
Iranian state-linked hackers use CHOSEN BRICK Windows malware, spread via Telegram and WhatsApp social engineering, to spy on dissidents and journalists worldwide.
US, UK, and Dutch cyber agencies with the FBI issued a joint advisory on Iranian state-linked hackers deploying a Windows malware strain called CHOSEN BRICK against dissidents, activists, and journalists, primarily in the US, UK, and Netherlands. Attacks begin with messages on WhatsApp or Telegram impersonating trusted contacts or technical support, tricking victims into running malicious files disguised as apps such as Pictory, RunwayML, Norton Antivirus, Telegram, and KeePass. The malware persists via Registry Run keys, adds Microsoft Defender exclusions, and uses a per-victim Telegram bot for command-and-control while stealing email, Telegram and WhatsApp data, screenshots, and audio. Stolen data is exfiltrated via Telegram or cloud services like VultrObjects and StorjShare, and sometimes appears on pro-Iranian leak sites, increasing physical risk for dissidents abroad.
78
Week in review: High-severity LPE vulnerability in the Linux kernel, cPanel 0-day exploited for months
60
60
60
Week in review: Sudo local privilege escalation flaws fixed, Google patches actively exploited Chrome
60
Week in review: Microsoft patches 5 actively exploited 0-days, recently fixed Chrome vulnerability exploited
60