CenterPoint Energy disclosed to federal regulators on Sept. 14 that an unauthorized party obtained personal information belonging to some of its customers through an external-facing system, days after a post on a cybercrime forum advertised a data set the seller said covered roughly 7.5 million customer records.

The Houston-based utility, which delivers electricity and natural gas to about 7 million metered customers across Indiana, Minnesota, Ohio and Texas, said in a Form 8-K that it learned of the online post this month and opened an investigation with outside forensic experts. It has reported the matter to law enforcement.

Operations were not affected. The filing states that the company's "delivery of electric and gas services has not been impacted" and remains undisrupted — a distinction that matters for a utility, where regulators and customers draw a sharp line between the theft of billing records and interference with grid operations.

CenterPoint has not confirmed the volume or authenticity of the advertised data set, and has not described how the intruder got in or how long access persisted. The forum poster, using a hexadecimal-styled handle, claimed to have pulled the records from an API endpoint that lacked adequate authentication and rate limiting, and listed fields including customer names, phone numbers, email addresses, service and billing addresses, account and premise identifiers, billing amounts and past-due balances, billing and due dates, service and rate information, autopay and paperless billing status, driver’s license numbers, last four digits of Social Security numbers.

Also read: Origin Energy Data Breach Affects 900,000 Current and Former Customers

The actor claimed, additional identity information was exposed through a second account-verification function. According to the post, the extraction was split across seven parallel data ranges covering Texas and Minnesota. The actor said that security changes, including CAPTCHA enforcement, were eventually enforced and that prevented further data collection. These claims remain unverified.

Plaintiffs' firms moved faster than the investigation. At least one has already announced an inquiry into potential claims on behalf of affected customers — now a standard sequel to any large consumer breach at a regulated utility.

The incident is not CenterPoint's first brush with data exposure; the company was linked to earlier third-party file-transfer compromises, though analysts at the time judged much of that data to have originated outside its systems.

The best brand protection solutions in 2026 combine AI-driven detection across domains, marketplaces, social media, and the dark web with fast, verified takedown execution. Cyble, BrandShield, and Red Points lead on different strengths — threat-intelligence depth, channel breadth, and marketplace automation, respectively — so the right pick depends on which abuse surface threatens your brand most.  Brand impersonation, fake domains, counterfeit listings, and phishing campaigns that spoof a company's identity have moved from a marketing nuisance to a security and fraud problem. This list compares ten brand protection platforms on what they actually do well, who they're built for, and where each one falls short — so you can shortlist based on your threat profile instead of a vendor's own pitch. 

What Makes the Best Brand Protection Solutions in 2026 

The strongest platforms in this category share four traits: continuous monitoring across surface, deep, and dark web channels; AI-assisted detection that keeps false positives low; verified (not just automated) takedown execution; and reporting that connects brand incidents to broader security or fraud context. Where vendors differ is in which abuse surface they were built to solve first — counterfeit marketplace listings, phishing and domain infrastructure, social media impersonation, or trademark enforcement — which is why most security and brand teams end up choosing based on their dominant threat, not a single "best overall" score.

1. Cyble — Best for Brand Protection Tied to Threat Intelligence

Cyble's Brand Intelligence module sits inside its broader Cyble Vision threat-intelligence platform, so brand abuse detection — fake domains, phishing sites, fraudulent mobile apps, executive and social media impersonation — is correlated with dark web chatter, leaked credentials, and attack surface data rather than tracked in isolation. That correlation is the main differentiator: a security team already using Cyble for threat intel gets brand monitoring without standing up a separate tool or data feed. 

• Best for: Security teams that want brand protection unified with dark web monitoring and attack surface management, not a standalone point solution. 
• Trade-off: Its marketplace/counterfeit-listing enforcement is less specialized than vendors built specifically for e-commerce abuse — brands whose primary problem is counterfeit products on Amazon or TikTok Shop may find more purpose-built workflows elsewhere. 

2. BrandShield — Best for Coverage Across Channels

BrandShield covers websites, marketplaces, social media, paid ads, mobile apps, and the dark web from a single dashboard, using a hybrid of AI detection and human analyst review to keep false-positive rates down. 

• Best for: Enterprises facing abuse across many channels at once who want one platform instead of stitching together point tools. 
• Trade-off: The breadth comes with enterprise-level pricing and onboarding that smaller teams may find heavier than necessary if they only face one or two threat types. 

3. Red Points — Best for Automated Marketplace and Counterfeit Takedowns

Red Points is built around high-volume, automation-first detection and takedown for counterfeit listings and IP infringement across marketplaces and social platforms, minimizing the manual review most legacy vendors still require. 

• Best for: E-commerce and consumer brands where counterfeit product listings are the dominant threat and takedown speed at scale matters more than case-by-case nuance. 
• Trade-off: Less flexible for broader digital threats like phishing infrastructure or executive impersonation, which sit outside its core automation model. 

4. ZeroFox — Best for Social Media and Executive Protection at Enterprise Scale

ZeroFox specializes in monitoring and disrupting threats on social platforms, including executive impersonation, fake accounts, and coordinated brand-abuse campaigns, backed by its own threat intelligence research team. 

• Best for: Enterprises where executive and social-channel impersonation is the primary risk, particularly in regulated or high-visibility industries. 
• Trade-off: Marketplace and counterfeit-listing coverage isn't its core strength compared to vendors purpose-built for e-commerce enforcement. 

5. Netcraft — Best for Phishing and Domain Takedown Speed

Netcraft has built its reputation on fast detection and takedown of phishing sites and malicious domain infrastructure, making it a common fit for financial services and other high-risk industries where phishing volume is constant. 

• Best for: Banks, fintechs, and other frequently-phished brands that need fast domain and phishing-site takedown above all else. 
• Trade-off: Less built out for social media impersonation or marketplace counterfeit monitoring than dedicated brand-protection suites. 

6. Corsearch — Best for Trademark and Legal-First Enforcement

Corsearch pairs trademark watching and legal research tools with marketplace and domain monitoring, positioning it closer to IP counsel workflows than a pure security operations tool. 

• Best for: Legal and IP teams that need trademark enforcement and domain monitoring managed through a legal-research lens. 
• Trade-off: Security teams looking for dark web or threat-intelligence correlation will find this outside its scope. 

7. MarqVision — Best for AI-Plus-Human Hybrid at Mid-Market Pricing

MarqVision combines AI-driven detection with human expert review in its enforcement workflows, positioned between fully automated platforms and high-touch legacy vendors on both capability and price. 

• Best for: Mid-market brands that want more oversight than a pure-automation tool but don't need enterprise-scale pricing. 
• Trade-off: Smaller analyst bench than larger enterprise vendors, which can matter during a high-volume incident. 

8. Bolster — Best for API-First Automated Phishing and Domain Detection

Bolster (formerly CheckPhish) focuses on automated, API-accessible detection of phishing sites and malicious domains, appealing to security teams that want to integrate brand-threat data directly into existing tooling rather than work from a separate dashboard. 

• Best for: Security engineering teams that want to pipe brand-threat detection into their own SIEM or SOAR rather than manage another standalone console. 
• Trade-off: Less suited to teams that want a managed, dashboard-driven experience with heavy analyst involvement. 

9. Recorded Future (Brand Intelligence) — Best for Integrating with an Existing Threat Intel Program

Recorded Future's Brand Intelligence module extends its broader threat-intelligence platform to cover impersonation and brand abuse, making it a natural add-on for organizations already standardized on Recorded Future for threat intel. 

• Best for: Organizations already running Recorded Future as their primary threat-intel platform who want brand monitoring in the same system. 
• Trade-off: Adopting it purely for brand protection, without the broader platform, is a heavier commitment than most standalone brand-protection vendors require. 

10. CSC — Best for Enterprise Domain Portfolio and DNS-Led Brand Protection

CSC approaches brand protection from domain and DNS security — managing large enterprise domain portfolios, monitoring for look-alike registrations, and layering brand abuse monitoring on top of that infrastructure. 

• Best for: Large enterprises that already manage domain portfolios through CSC and want brand-abuse monitoring layered onto existing domain security. 
• Trade-off: Less focused on social media or marketplace counterfeit detection than dedicated brand-protection platforms. 

How to Choose Among the Best Brand Protection Solutions 

Vendor	Core Strength	Best Fit
Cyble	Threat intel + brand correlation	Security teams wanting unified dark web + brand monitoring
BrandShield	Channel breadth	Enterprises facing multi-channel abuse
Red Points	Marketplace automation	E-commerce counterfeit enforcement at scale
ZeroFox	Social + executive protection	High-visibility executives, regulated industries
Netcraft	Phishing/domain takedown speed	Financial services, frequently-phished brands
Corsearch	Trademark/legal enforcement	IP and legal teams
MarqVision	AI + human hybrid	Mid-market brands
Bolster	API-first detection	Security engineering teams
Recorded Future	Threat intel integration	Existing Recorded Future customers
CSC	Domain/DNS-led protection	Enterprises with large domain portfolios

Frequently Asked Questions About Best Brand Protection Solutions

What is a brand protection software? 

Brand protection software monitors the internet — websites, marketplaces, social media, app stores, and the dark web — for unauthorized use of a company's name, logo, or identity, then helps detect and remove that abuse. 

Why do companies need brand protection in 2026? 

Generative AI has made it faster and cheaper for attackers to clone a brand's visual identity, spin up convincing phishing sites, and run impersonation campaigns at scale, increasing both the volume and realism of brand abuse. 

What's the difference between brand protection and trademark monitoring? 

Trademark monitoring focuses narrowly on unauthorized use of registered marks for legal enforcement, while brand protection covers a wider range of abuse, including phishing, fake apps, and social media impersonation, often from a security rather than legal angle. 

Is Cyble a brand protection company or a broader cybersecurity company? 

Cyble is a broader AI-native threat intelligence company; brand protection is one of their strongest module (Brand Intelligence) inside its Cyble Vision platform, alongside dark web monitoring and attack surface management. 

Which brand protection tool is best for e-commerce counterfeits specifically? 

Red Points is generally considered the strongest fit for high-volume, automated counterfeit-listing takedown on marketplaces like Amazon and TikTok Shop. 

Which brand protection tool is best for phishing-heavy industries like banking? 

Netcraft is widely used by financial services firms specifically for fast phishing-site and malicious-domain takedown. 

Can brand protection tools stop deepfake impersonation of executives? 

Some platforms, including ZeroFox and Cyble, monitor for executive impersonation and synthetic media abuse, though detection accuracy for deepfakes specifically is still an evolving capability across the industry. 

Do brand protection platforms guarantee takedowns? 

No platform can guarantee a takedown, since removal ultimately depends on the hosting platform, registrar, or marketplace acting on a request; vendors differ mainly in takedown speed and success rate. 

How much does brand protection software cost? 

Pricing varies widely by vendor and scope, from mid-market platforms priced for smaller teams to enterprise contracts that scale with monitoring volume and takedown quotas; most vendors require a custom quote. 

What should be in a brand protection contract? 

Look for specific takedown SLA commitments by severity, clarity on what's bundled versus add-on, takedown quotas and overage pricing, evidence retention rights, and renewal pricing protection. 

Does brand protection cover social media impersonation? 

Most modern platforms, including ZeroFox, BrandShield, and Cyble, monitor for fake social media accounts and impersonation, though depth of coverage varies by vendor. 

What is a fake domain or look-alike domain? 

A look-alike domain mimics a legitimate brand's URL (through typos, extra characters, or different extensions) to trick users into believing they're on the real site, often as the first step in a phishing campaign. 

How do brand protection tools detect fake mobile apps? 

They scan app stores for apps using a brand's name, logo, or trademarked assets without authorization, flagging suspicious apps for review and takedown. 

What industries need brand protection most? 

Financial services, retail and e-commerce, healthcare, and any consumer-facing brand with significant online transaction volume face the highest exposure to brand impersonation and phishing. 

Is dark web monitoring part of brand protection? 

It often is for platforms built on a broader threat-intelligence base, like Cyble and Recorded Future, since brand-related credentials and impersonation kits are frequently traded on dark web forums before being deployed. 

What's the difference between detection and enforcement in brand protection? 

Detection is identifying abuse (a fake site, a counterfeit listing, an impersonating account); enforcement is the takedown process that actually gets it removed — vendors vary significantly in how much of enforcement is automated versus manual. 

Can small businesses afford brand protection software? 

Some mid-market platforms, like MarqVision, are positioned specifically for smaller teams that need coverage without enterprise-level pricing, though most established vendors still target mid-size to large organizations. 

How long does a typical takedown take? 

Timelines vary by vendor, threat type, and the hosting platform's own response process; ask vendors for measurable SLA commitments by severity tier rather than vague language like "prompt response." 

What is executive impersonation? 

Executive impersonation involves attackers creating fake social media profiles or communications that mimic a company's leadership, often used for fraud, phishing, or reputational damage. 

Do brand protection tools integrate with security operations (SOC) tools? 

Some do — Bolster is built API-first for SIEM/SOAR integration, and platforms built on broader threat-intel bases (Cyble, Recorded Future) naturally feed brand data into existing security workflows. 

What is business email compromise (BEC) and how does it relate to brand protection? 

BEC involves attackers impersonating a company or executive via email to defraud employees or partners; brand protection platforms that monitor phishing infrastructure and domain abuse help reduce the infrastructure BEC attacks rely on. 

Should legal teams or security teams own brand protection? 

It depends on the organization's dominant threat: trademark-first enforcement (Corsearch) tends to sit with legal/IP teams, while phishing- and impersonation-heavy programs (Netcraft, ZeroFox, Cyble) tend to sit with security teams. 

What is a takedown success rate and how is it measured? 

It's the percentage of flagged abuse (a fake site, listing, or account) that a vendor successfully gets removed; ask vendors how they calculate this figure and over what time window, since methodology varies. 

Can AI reduce false positives in brand monitoring? 

AI-assisted detection is designed to reduce false positives compared to manual monitoring, but most reputable vendors still pair AI with human review for verification before enforcement action. 

What is the difference between BrandShield and Red Points? 

BrandShield covers a broader range of channels including phishing and social media, while Red Points is more specialized and automation-heavy specifically for marketplace counterfeit enforcement. 

Does brand protection help with paid ad abuse? 

Some platforms, including BrandShield, monitor for unauthorized use of a brand's identity in paid search and social ads, which is a growing abuse vector alongside marketplace and phishing threats. 

What data sources feed brand protection platforms? 

Sources typically include surface web crawling, marketplace and app store scanning, social media APIs, domain registration data, and — for platforms with a threat-intel base — dark web forums and marketplaces. 

How do I evaluate brand protection vendors during a trial? 

Test detection accuracy on known abuse cases, ask for real takedown SLA numbers rather than marketing language, and confirm how enforcement actions are verified before being reported as resolved. 

Is brand protection a compliance requirement in any industry? 

It's not typically a direct regulatory requirement, but financial services and healthcare organizations often adopt it as part of broader fraud-prevention and customer-protection obligations. 

What's a common mistake companies make when choosing a brand protection vendor? 

Assuming AI detection alone is sufficient without adequate human oversight or without matching the vendor's core specialty (marketplace, phishing, social, or trademark) to the brand's actual dominant threat.  Prepared for the Cyble Knowledge Hub. Vendor information reflects publicly available product documentation as of September 2026 and should be independently verified before publication, particularly pricing, SLA figures, and takedown-rate claims. 

Pakistan's federal government has completed work on a 90-day cybersecurity action plan designed to build a more coordinated national defense against digital threats, bringing together federal and provincial governments, regulators and operators of critical infrastructure under one framework.  The Cyber Security Working Committee (CSWC) drafted the plan and functions as a subordinate body of the National Committee for Information and Communications Security (NCICS).   Its scope is broad: setting up a Federal CERT, activating provincial CERTs, drafting a five-year national cybersecurity strategy, building a cyber warfare escalation matrix, safeguarding critical infrastructure, and creating a dedicated career track for cybersecurity and emerging-technology specialists. 

CSWC's Mandate and Structure for the Cybersecurity Action Plan

The CSWC has been asked to close existing gaps in the country's cyber defenses by coordinating national CERTs, ministries at both federal and provincial levels, and other stakeholders.   Its goals include a unified governance model for cybersecurity, better visibility into digital assets and vulnerabilities, stronger baseline controls, protection for Critical Information Infrastructure (CII), coordinated incident response, workforce and academic development, and safer practices for acquiring and retiring public-sector technology.   The 90-day cybersecurity action plan is organized around six themes: governance, compliance, resource alignment, incident response and crisis management, security assessment, and supply chain security.  Chaired by the Director General of NCERT, the CSWC also includes the Secretary of NTISB, the Cabinet Division, the Chairman of PTA, a Member of the Ministry of IT and Telecom, and representatives from the Pakistan Digital Authority, PTA, NADRA, NTC, and NITB, along with a director from the former NCERT.   Co-opted members represent the provinces, Gilgit-Baltistan, Azad Jammu and Kashmir, ISI's technical wing, the Ministry of Interior's NCCIA, and outside experts. The committee will run gap assessments based on completed audits, review existing policies against international norms, and recommend technical controls for sectors including health, energy, aviation and transport. 

Federal CERT Tops the Priority List 

Establishing a Federal CERT (FCERT) is the plan's priority, tasked with detecting, monitoring and analyzing threats across government while issuing advisories to ministries and divisions. NCERT will define its mandate and legal standing, and together with NTISB and the IT Ministry will prepare funding and implementation proposals.   The plan targets 40 percent operationalization of the Federal CERT within 365 days, against a total project timeline of three years, with rules for engaging 39 ministries and divisions to be developed on an ongoing basis.   Provincial CERTs form the second part of this priority, with NCERT and CSWC issuing technical and administrative guidance within 90 days for notification through provincial chief secretaries. 

Strategy, Escalation and Infrastructure Protection 

The plan notes that since the National Cyber Security Policy 2021, few sectors have built dedicated strategies — PTA's 2023-2028 strategy being an exception — while sectors like oil and gas remain without one.   A CSWC subcommittee will draft a Cyber Warfare Escalation Matrix within 60 days, covering escalation levels and response chains, with public consultation and finalization due in 90 days. Separately, NCERT will identify critical infrastructure and CII, and produce a declaration framework and protective guidelines within the same 90-day window. 

Workforce and Next Steps 

The final priority involves creating a specialized service structure for professionals working in cybersecurity, AI, and quantum computing, aimed at retaining talent. NCERT will also work with the Higher Education Commission and Pakistan Engineering Council to reform related curricula.   NCICS will oversee monitoring and progress reporting as regulators and provincial authorities manage implementation locally. 

A new Apple security update has been dropped for iPhone owners, releasing iOS 26.7 alongside its major annual release, iOS 27. The move gives iPhone users who are hesitant to jump straight into a full system overhaul a safer, lighter-weight path to staying protected, arriving less than a month after the previous patch, iOS 26.6.1.  As is typical with Apple's security releases, the company has kept details about what iOS 26.7 actually fixes deliberately sparse. The idea is simple: the fewer specifics made public, the less material attackers have to work with before the update reaches the majority of devices. 

One of Apple's Largest Coordinated Patches Yet 

This release is part of a much bigger rollout. On September 14, 2026, Apple pushed updates across nearly its entire product line — iPhone, iPad, Mac, Apple Watch, Apple TV, Vision Pro, Safari, and Xcode — through iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27, and Xcode 27, in addition to iOS and iPadOS 26.7, macOS Tahoe 26.7, and macOS Sequoia 15.8.  In total, the Apple security update resolves 273 unique vulnerabilities. That figure comes from consolidating 1,038 product-level CVE entries spread across ten separate advisories, since many flaws sit in shared frameworks and therefore show up in multiple operating systems at once. macOS Golden Gate 27 accounts for the largest share, with 210 CVEs, followed by macOS Sequoia 15.8 at 154 and macOS Tahoe 26.7 at 153. 

Notable Vulnerabilities Addressed 

Several of the fixes stand out for their severity. CVE-2026-65414 involved an out-of-bounds write in Bluetooth that could have let a remote attacker crash an app or run malicious code. CVE-2026-84607, a race condition in AVEVideoEncoder, could have allowed a sandboxed app to execute code with kernel-level privileges — both resolved through tighter bounds checking and better state management.  Media handling was another weak point. CoreMedia's CVE-2026-64752 could have triggered code execution from a maliciously crafted image, while ImageIO's CVE-2026-65395 risked memory corruption. Apple also patched issues in FontParser, CoreText, CoreUI, SceneKit, RealityKit, Model I/O, and disk-image handling tools.  On the Mac side, fixes targeted privilege-escalation risks in autofs (CVE-2026-84568) and CUPS (CVE-2026-43692), plus a Screen Sharing Server flaw (CVE-2026-65400) that could have let attackers bypass login credentials over a network. Gatekeeper, sandboxing, TCC privacy controls, and file-system protections for SMB, WebDAV, APFS, HFS, and exFAT were all hardened as well.  WebKit received a heavy round of fixes too, with Safari 27 alone patching six CVEs — including one letting cross-site scripting attacks run via a malicious webarchive, and another risking data exposure during web-content processing.  For iPhone specifically, iOS 26.7 closes 16 kernel-level vulnerabilities, the most severe being CVE-2026-43689, which could have granted a malicious app root access. It also fixes five ImageIO bugs and a WebKit use-after-free flaw, CVE-2026-43715, capable of corrupting memory through crafted web content. 

Which Update Should iPhone Users Install? 

iPhone owners will see iOS 26.7 offered prominently in Settings, with iOS 27 listed as a secondary option — a structure Apple maintains for months after a major release, largely to reassure users and businesses wary of early bugs in new software. iOS 26.7 supports iPhone 11 and later, along with a range of iPad Pro, iPad Air, iPad, and iPad mini models.  Although automatic updates are generally recommended, Apple's staged rollout can take days or weeks to reach every device, so security specialists suggest installing iOS 26.7 manually via Settings > General > Software Update. 

The Manhattan District Attorney’s Office has seized the domains of 12 websites allegedly used to create, sell and distribute AI-generated deepfake videos featuring approximately 1,200 real people without their consent. Authorities said the websites were used to publish and sell non-consensual intimate imagery created with artificial intelligence tools. The seizure, announced by Manhattan District Attorney Alvin L. Bragg Jr., involves what the office described as the largest known seizure of websites dedicated to AI-generated celebrity deepfakes to date. The investigation remains ongoing.

AI-Generated Deepfake Videos Target 1,200 People

According to the Manhattan District Attorney’s Office, individuals under investigation allegedly used AI image and video creation tools to transform existing photographs and videos of around 1,200 people into hyper-realistic images and videos depicting them engaging in sexual conduct. [caption id="attachment_114113" align="aligncenter" width="600"] Image Source: https://manhattanda.org/[/caption] The websites were allegedly dedicated almost exclusively to deepfake pornography and explicitly promoted AI-generated content. The material was then distributed, published and sold through the websites. The approximately 1,200 people affected were overwhelmingly women, according to the D.A.’s Office. Many were public-facing individuals, including actors, politicians, athletes, musicians, social justice advocates and social media influencers. The office said the images and videos were created without the knowledge or consent of the people depicted.

12 Domains Seized Under Court Order

The Manhattan D.A.’s Office said the 12 domains were seized pursuant to a court order as part of the criminal investigation. Authorities said they will continue monitoring the websites to prevent the operations from returning under different domain names. [caption id="attachment_114112" align="aligncenter" width="600"] Image Source: https://manhattanda.org/[/caption] The office is also urging people who believe they were affected to contact its Cyber Crime Bureau at 212-335-9600. The investigation comes as authorities examine websites allegedly built around the creation and distribution of non-consensual intimate imagery using artificial intelligence. District Attorney Bragg said the office would continue investigating the websites and similar operations. He also called on people affected by the websites to come forward.

Manhattan D.A. Expands Domain Seizures

The Cyber Crime Bureau has previously seized domains connected to other criminal investigations, according to the D.A.’s Office. Those cases included 12 domains from five online vendors accused of selling stolen credit and debit card information and personal identifying information. The office said those operations involved more than one million stolen cards belonging to people across the United States, including tens of thousands of New Yorkers. The bureau also seized the domain associated with Coin Dispute Network. The company was later indicted, along with its creators Michael Lauchlan and Gary Zaydman, over allegations that it stole from customers by falsely claiming it could trace and recover cryptocurrency for a fee. In the current investigation, Assistant District Attorneys Lotus Ho and Katherine Ellis are handling the case under the supervision of senior officials within the Cyber Crime Bureau and Investigation Division. The D.A.’s Office said its investigation into the 12 AI-generated deepfake websites and other potentially related operations is continuing.

Ukraine has appointed Ihor Klymenko to lead the country’s National Cybersecurity Coordination Center (NCCC), placing the former law enforcement official at the center of the government’s Ukraine cybersecurity coordination efforts. President Volodymyr Zelensky made the appointment through a decree dated September 14, 2026. The National Cybersecurity Coordination Center operates under Ukraine’s National Security and Defense Council (NSDC) and brings together government agencies responsible for cybersecurity. Klymenko’s appointment puts him in charge of the body responsible for coordinating the country’s response to major cyberthreats.

Ihor Klymenko Takes Over Cybersecurity Role

According to the presidential decree, Ihor Klymenko, identified in the document as the Secretary of Ukraine’s National Security and Defense Council, has been appointed head of the NCCC. The decree changes the existing provision governing the leadership of the center and took effect upon publication. Klymenko succeeds Rustem Umerov, who previously headed the National Cybersecurity Coordination Center. The leadership change comes as Ukraine continues to focus on protecting critical infrastructure and government systems amid ongoing security challenges. The appointment gives Klymenko responsibility for a national body that coordinates cybersecurity activities across government agencies. The NCCC’s role places it within the country’s wider national security structure, linking cybersecurity coordination with the work of the NSDC.

Cybersecurity Coordination Expands Beyond Digital Systems

The appointment comes alongside a broader government focus on protecting critical infrastructure. In a September 15 address, Zelensky said a staff meeting had focused on protecting critical infrastructure, the energy system and logistics, with particular attention given to Ukraine’s railway network. Zelensky said additional contracts would be issued for systems intended to strengthen the protection of railways, border crossings and other facilities operated by Ukrzaliznytsia, Ukraine’s state railway operator. He said decisions on those contracts had already been made. The president also discussed efforts to protect Ukraine from attack drones, saying interceptor systems were being developed and tested. He reported that another Ukrainian interceptor solution had successfully hit a Shahed drone during testing, although technical aspects still required refinement. According to Zelensky, interceptor crews achieved a 93% interception rate against regular Shaheds during the previous night. He said the government was directing state resources and funding toward additional forms of protection against attack drones.

Ukraine Cybersecurity Efforts Under National Security Structure

The NCCC’s position within the National Security and Defense Council places cybersecurity coordination within Ukraine’s broader national security framework. The center brings together government agencies responsible for cybersecurity and is tasked with coordinating responses to major cyberthreats. The leadership change therefore places Klymenko at the head of a body responsible for coordinating government-level cybersecurity activity, while Ukraine continues to strengthen protections for critical infrastructure and other essential systems. The presidential decree does not provide further details about changes to the NCCC’s mandate or announce specific new cybersecurity programs following Klymenko’s appointment. It formally establishes his leadership of the center following Umerov’s tenure.

The file looked like an MRI scan. Lumbar spine, several grey slices of vertebrae, a heading reading something like 'Disk Herniation and Degeneration.' For a dissident living in exile - someone with a body that has been through things, someone waiting on results - it was a plausible thing to open.

Opening it handed Iranian intelligence the microphone.

That lure, reproduced in a joint advisory published Monday by Britain's National Cyber Security Centre, the U.S. Federal Bureau of Investigation and the Netherlands' General Intelligence and Security Service, is one of several used to deliver a spyware family the NCSC has named "CHOSEN BRICK." The three agencies say Iranian state cyber actors have used it since at least 2025 against dissidents, activists and journalists worldwide, including in all three of their countries.

What makes the campaign notable is not its technical sophistication. By the standards of state espionage, CHOSEN BRICK is unglamorous - Windows only, no automated spread, command-and-control running over Telegram bots. What makes it notable is the patience of the human work wrapped around it, and what appears to happen to the data afterward.

Getting to know you first

The operators do not spray phishing links. They research a target, then open a conversation on WhatsApp or Telegram posing either as someone the target already knows or as technical support from the messaging platform itself. Then they talk. The advisory describes rapport-building as a distinct phase of the attack chain, drawing on what it calls extensive target knowledge gathered in preparation.

Only after that does a file arrive, themed to whatever the conversation has been about — a video tool like Pictory or RunwayML, a password manager, an antivirus installer, medical results. Open it and a convincing screen appears: a real-looking Pictory login page, a real-looking scan. Behind it, the implant installs.

The single most telling detail in the advisory is a paragraph about which device gets hit. The actors often approach a target's work computer first. If that fails, or if detection looks likely, they ask the target to open the file at home instead - deliberately steering the victim off a monitored corporate machine and onto the personal laptop where nobody is watching. That is not a technical exploit. It is an understanding of how a journalist's life is actually configured.

What CHOSEN BRICK malware does

A bot for every victim

Once installed, the malware survives reboots through a registry run key, writes itself Microsoft Defender exclusions, and reports to a Telegram bot. It can enumerate running processes, grab the screen, switch on the microphone, lift Telegram and WhatsApp session data out of browsers, pull email, download further payloads and delete files. The NCSC says one sample also carried data-wiping functionality, though the FBI's own 55-page technical breakdown, published the same day, documents no wiper.

Two design choices stand out. First, each infected device talks to its own unique Telegram bot ID — an operational security measure, the advisory notes, to prevent cross-contamination between victims. The people hunting dissidents are careful to compartmentalize their victims from one another.

Second, one payload documented by the FBI kills the real WhatsApp process and substitutes a trojanized copy, rewriting the desktop shortcut to point at it. The victim keeps using WhatsApp. WhatsApp keeps working. Another sample dumps entire Outlook mailboxes, attachments included, to a zip archive. Others stage screen and audio recordings into password-protected archives before shipping them out through Telegram or cloud object storage.

The FBI calls the same malware HEAVYGRAM, and goes considerably further than its British counterpart on attribution. Its report states plainly that the activity is conducted "on behalf of the Government of Iran's Ministry of Intelligence and Security" — MOIS. The NCSC advisory says only "Iranian state cyber actors." That gap between two co-signing agencies is unusual enough to be worth noticing.

Where the data goes

Espionage against exiles would be alarming enough. The advisory's quietest sentence is the one that should worry readers most: personal details of some previous CHOSEN BRICK victims have turned up on pro-Iranian leak sites.

That is the hinge between surveillance and harm. A stolen contact list is not just intelligence; published, it is a map of everyone a dissident in London still speaks to in Tehran. In May, Global Affairs Canada documented a July 2025 hack-and-leak by the Iran-linked Handala persona that exposed five Iran International staff — passports, driver's licences, permanent resident cards, email passwords, and intimate photographs — then amplified the material across social platforms. The U.S. Justice Department seized four Iranian-linked leak and harassment domains in March 2026, and the FBI has separately assessed that some data posted by Handala was obtained using this malware. No public document yet ties the Iran International leak specifically to CHOSEN BRICK, but the timelines converge uncomfortably.

Read: Iran-Linked Handala Hackers Launch New Domain Hours After FBI Seized the Older One

Paul Chichester, the NCSC's director of operations, said the campaign shows how Iran "ruthlessly uses digital surveillance in pursuit of its aim to repress critics," urging those at risk to study the social-engineering patterns described and act on the advice. Dutch intelligence said victims in the Netherlands have been informed. No agency published a victim count, and none should be inferred.

Why a microphone matters

The reason a spyware advisory about contact lists and screenshots reads like a physical-safety story is that, in this particular threat model, it is one.

Ruhollah Zam ran a Telegram channel with more than a million followers from exile in Paris. In October 2019 he was lured to Iraq with the offer of an exclusive interview, seized on arrival, and hanged in December 2020. Masih Alinejad, the Iranian-American journalist, survived both a plot to render her out of New York and a murder-for-hire attempt; two men were sentenced to 25 years each in October 2025. Pouria Zeraati, an Iran International presenter, was stabbed outside his London home in March 2024; two men were jailed at the Old Bailey in July 2026, where the judge found the attack was carried out for the benefit of a foreign power.

MI5 Director General Sir Ken McCallum said in his October 2025 threat update that the service had tracked "more than 20 potentially lethal Iran-backed plots" in a single year — roughly matching the total for the preceding three.

Against that backdrop, a stranger's warmth on WhatsApp and a file that looks like your scan results are not a nuisance. They are reconnaissance. The advisory's most practical instruction is also its bluntest: do not let a persuasive contact move you onto the device where no one is watching.