The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Civic/Social Organization
Breach intelligence, attack campaigns, and threat reports targeting the Civic/Social Organization sector.
Explore Other Sectors
Civic/Social Organization Threat Reports
Iranian State Hackers Deploy CHOSEN BRICK Malware in Global Espionage Campaign
Iranian state-linked hackers deployed CHOSEN BRICK malware in a sophisticated espionage campaign targeting dissidents, activists, and journalists in the U.S., U.K., and Netherlands throughout 2026. The attack began with social engineering via WhatsApp and Telegram, where threat actors impersonated trusted contacts to deliver malicious files disguised as legitimate applications like Norton Antivirus, Adobe Flash Player, and KeePass. Once installed, CHOSEN BRICK established persistence through Windows Registry modifications, evaded detection by adding Microsoft Defender exclusions, and exfiltrated sensitive data including email communications, Telegram and WhatsApp messages, screenshots, and audio recordings through Telegram bots and cloud storage services. This campaign exemplifies the growing sophistication of nation-state actors leveraging popular communication platforms and cloud infrastructure for command-and-control operations, highlighting the urgent need for enhanced detection capabilities against encrypted communications channels and cloud-based data exfiltration.
1 week ago
Kill Chain
Iranian Intelligence Weaponizes Telegram in Global HEAVYGRAM Espionage Campaign
Since autumn 2023, Iran's Ministry of Intelligence and Security (MOIS) has deployed sophisticated malware called HEAVYGRAM (FBI designation) or CHOSEN BRICK (UK NCSC designation) to conduct extensive cyber espionage operations targeting Iranian dissidents, journalists, and activists worldwide. The Windows-based malware uses Telegram messaging app for command and control, enabling attackers to steal emails, capture screenshots, record audio through microphones, and exfiltrate sensitive communications. Victims are initially compromised through social engineering tactics where attackers impersonate trusted contacts or technical support, delivering malicious files disguised as legitimate applications like Adobe Flash, Norton Antivirus, or even medical scan results. This campaign represents a significant escalation in state-sponsored surveillance capabilities, demonstrating how authoritarian regimes are weaponizing popular communication platforms for transnational repression. The targeting extends beyond digital espionage, with stolen personal information being published on Iranian leak sites to endanger victims' physical safety, highlighting the intersection of cyber operations with traditional intelligence gathering and intimidation tactics.
1 week ago
Kill Chain
Serbian Activists Targeted in Largest Documented Pegasus and NoviSpy Spyware Campaign
In early 2026, researchers discovered the first confirmed Pegasus spyware infection of the year alongside NoviSpy variant infections targeting 14 Serbian individuals, including student activists, a parliament member, and local government official. The SHARE Foundation documented this as the largest wave of surveillance in Serbia to date, coinciding with local elections and student protests following the 2024 Novi Sad railway station collapse. Pegasus infections utilized zero-click exploits from December 2025 to January 2026, while NoviSpy variants were deployed during police detention and questioning of activists. This incident highlights the continued weaponization of commercial spyware against civil society and democratic movements, demonstrating how state-sponsored surveillance capabilities are increasingly deployed to suppress political dissent and monitor opposition activities during critical electoral periods.
3 weeks ago
Kill Chain
Russia's Unauthorized Use of Cellebrite Tools on Activist's iPhone
In June 2021, Russian authorities utilized Cellebrite's Universal Forensic Extraction Device (UFED) to access the iPhone of detained opposition activist Andrey Pivovarov. This occurred three months after Cellebrite announced the cessation of sales and services to Russian government clients in March 2021. Forensic evidence and Russian court documents confirm that investigators extracted data, including WhatsApp and Telegram messages, and searched for political terms and opposition figures. This incident underscores the challenges technology vendors face in controlling the use of their tools post-sale, especially when used by authoritarian regimes. The continued operation of Cellebrite's tools in Russia, despite the termination of official support, highlights the need for more robust mechanisms to prevent misuse of surveillance technologies.
3 months ago
Kill Chain
Russia's Continued Use of Cellebrite Tools Raises Concerns
In June 2021, Russian authorities utilized Cellebrite's Universal Forensic Extraction Device (UFED) to access the iPhone of detained human rights activist Andrey Pivovarov. This occurred despite Cellebrite's public announcement in March 2021 that it had ceased all sales and services to Russian government agencies. The extracted data reportedly included communications from encrypted messaging apps, which were subsequently used to surveil other dissidents. This incident underscores the challenges technology companies face in controlling the use of their tools post-sale, especially when they are employed for political repression. The case highlights the need for robust mechanisms to prevent the misuse of surveillance technologies by authoritarian regimes, even after contractual relationships have been terminated.
3 months ago
Kill Chain
WhatsApp Thwarts NSO Group's Latest Spyware Phishing Attacks
In June 2026, WhatsApp identified and disrupted spear-phishing campaigns linked to the NSO Group, an Israeli spyware vendor known for its Pegasus tool. These attacks involved social engineering tactics, attempting to lure users into clicking malicious links that redirected them to external websites, aiming to deploy spyware. This activity violated a 2025 U.S. court injunction that barred NSO from targeting WhatsApp and its users. Meta, WhatsApp's parent company, responded by filing a federal court contempt order against NSO for this breach. This incident underscores the persistent threat posed by commercial spyware vendors and highlights the importance of robust security measures and legal frameworks to protect user privacy and national security.
3 months ago
Kill Chain
Bitter APT's Hack-for-Hire Campaign Targets MENA Journalists
In a series of cyber espionage activities from 2023 to 2024, the Bitter APT group, suspected to have ties to the Indian government, orchestrated a hack-for-hire campaign targeting journalists, activists, and government officials across the Middle East and North Africa (MENA) region. Notably, Egyptian journalists Mostafa Al-A'sar and Ahmed Eltantawy were subjected to spear-phishing attacks aimed at compromising their Apple and Google accounts. These attacks involved deceptive emails leading to counterfeit login pages designed to harvest credentials and two-factor authentication codes. ([thehackernews.com](https://thehackernews.com/2026/04/bitter-linked-hack-for-hire-campaign.html?utm_source=openai)) This incident underscores a concerning trend of state-affiliated threat actors employing sophisticated social engineering tactics to infiltrate the accounts of individuals critical of governmental policies. The Bitter APT group's activities highlight the persistent and evolving nature of cyber threats targeting civil society in the MENA region. ([accessnow.org](https://www.accessnow.org/press-release/hack-for-hire-new-report-egyptian-journalists/?utm_source=openai))
5 months ago
Kill Chain
Unveiling the 2023-2024 Hack-for-Hire Campaign Targeting Journalists in MENA
Between 2023 and 2024, a sophisticated hack-for-hire campaign targeted journalists and activists in the Middle East and North Africa, notably in Egypt and Lebanon. The attackers employed spear-phishing techniques, sending messages that appeared to be from legitimate sources to deceive victims into revealing personal data, including credentials and financial information. This campaign has been linked to the Bitter APT group, known for targeting government and critical infrastructure sectors across South Asia. The operation underscores the persistent threat posed by state-sponsored cyber espionage groups utilizing advanced social engineering tactics to infiltrate and compromise sensitive information. ([accessnow.org](https://www.accessnow.org/press-release/hack-for-hire-new-report-egyptian-journalists/?utm_source=openai))
5 months ago
Kill Chain
CRESCENTHARVEST Malware Campaign Exploits Iran Protests to Target Supporters
In early January 2026, a cyberespionage campaign named CRESCENTHARVEST emerged, targeting individuals supporting Iran's anti-government protests. Attackers distributed malicious archive files containing authentic protest media and Farsi-language reports, alongside disguised Windows shortcut (.LNK) files. When executed, these shortcuts deployed a remote access trojan (RAT) capable of executing commands, logging keystrokes, and exfiltrating sensitive data. The campaign's sophistication suggests alignment with Iranian state interests, aiming for long-term surveillance and information theft. This incident underscores the increasing use of geopolitical events as lures in cyberattacks, highlighting the need for heightened vigilance among activists, journalists, and dissidents. The campaign's reliance on social engineering and legitimate-looking media emphasizes the importance of verifying the authenticity of received files, especially those related to sensitive political contexts.
7 months ago
Kill Chain
Kenyan Activist's Phone Compromised by Cellebrite Extraction
In July 2025, Kenyan pro-democracy activist Boniface Mwangi was arrested, and his personal devices were confiscated by authorities. Upon their return in September 2025, Mwangi discovered that his Samsung phone's password protection had been removed. Forensic analysis by Citizen Lab revealed with high confidence that Kenyan authorities utilized Cellebrite's forensic extraction tools on his device during its custody, enabling full access to sensitive information including messages, personal files, financial data, and passwords. This incident underscores the potential misuse of advanced surveillance technologies by government entities to target civil society members. The case highlights the growing concerns over digital privacy and the ethical implications of deploying such tools without proper oversight, emphasizing the need for stringent regulations to prevent abuse and protect individual rights.
7 months ago
Kill Chain
RedKitten 2026: Iranian State-Sponsored Malware Targets Human Rights NGOs
In January 2026, a cyber espionage campaign named RedKitten targeted non-governmental organizations and individuals documenting human rights abuses in Iran. The attackers employed AI-generated malware, delivered through malicious Excel files disguised as casualty records from recent protests. Upon enabling macros, the malware, dubbed SloppyMIO, was deployed, utilizing GitHub and Google Drive for configuration and Telegram for command-and-control. This operation is attributed to Iranian state-sponsored actors aiming to infiltrate and disrupt human rights documentation efforts. ([harfanglab.io](https://harfanglab.io/insidethelab/redkitten-ai-accelerated-campaign-targeting-iranian-protests/?utm_source=openai)) This incident underscores the escalating use of artificial intelligence in cyber attacks, enabling rapid development and deployment of sophisticated malware. The targeting of human rights organizations highlights the increasing risks faced by civil society groups, emphasizing the need for enhanced cybersecurity measures and vigilance against state-sponsored cyber threats.
7 months ago
Kill Chain
WhatsApp Unveils "Strict Account Settings" to Combat Spyware in 2024
In June 2024, WhatsApp introduced a lockdown-style "Strict Account Settings" feature to counter the growing threat of spyware targeting its user base—including journalists, activists, and public figures. This proactive measure allows users to limit messaging and attachment options from unknown contacts, mitigating risks of exploitation similar to past incidents like the Pegasus spyware attacks. The rollout follows WhatsApp’s ongoing legal battles with threat actors and reflects the platform’s drive to strengthen user privacy and security in the wake of sophisticated surveillance malware campaigns. This development highlights an industry-wide shift towards advanced, user-accessible security controls as spyware campaigns become more adept at circumventing traditional defenses. Organizations and high-risk users face mounting pressure from both regulatory frameworks and adversary innovation, compelling tech platforms to continually adapt and raise the bar for account protection and threat mitigation.
7 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports