Skip to main content
Mallory
Back to threat actors
1 malware familyExploits CVEs in the wild

serbian_government

Also known asSerbian Government

The Serbian government is described in the provided content as exploiting CVE-2024-43047, a Qualcomm zero-day, to unlock and infect Android devices with a spyware tool named NoviSpy. According to the content, this activity was reported by Amnesty International and was used to spy on activists, journalists, and protestors. The activity is consistent with cyber espionage. No additional aliases, sub-groups, or further operational details are provided in the content beyond the alias "serbian_government".

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial
ARSENAL

Associated malware families

1 malware family attributed to this actor across reporting.

FamilyContextEvidenceLast seen
NoviSpyLast November, the company addressed a second Android zero-day (CVE-2024-43047) used by the Serbian government in NoviSpy spyware attacks...1Mar 18, 2026
WEAPONIZED

Associated vulnerabilities

3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.

CVE-2024-43047Use-after-free in Qualcomm DSP service / Android kernel componentsIn the wildEvidence1

Last November, the company addressed a second Android zero-day (CVE-2024-43047) used by the Serbian government in NoviSpy spyware attacks, which was first tagged as exploited by Google Project Zero in October.

CVE-2025-21479Incorrect Authorization in Qualcomm Graphics GPU MicronodeIn the wildEvidence1

The two security bugs, tracked as CVE-2025-21479 and CVE-2025-27038... The first is a Graphics framework incorrect authorization weakness that can lead to memory corruption due to unauthorized command execution in the GPU micronode... Qualcomm warned that... CVE-2025-21479... may be under limited, targeted exploitation. CISA has also added the two security bugs to its catalog of actively exploited vulnerabilities...

CVE-2025-27038Use-after-free in Qualcomm Adreno GPU drivers in ChromeIn the wildEvidence1

CVE-2025-27038... is a use-after-free vulnerability that causes memory corruption while rendering graphics using Adreno GPU drivers in Chrome... Qualcomm warned that... CVE-2025-27038 may be under limited, targeted exploitation. CISA has also added the two security bugs to its catalog of actively exploited vulnerabilities...

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Start free trial
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal1

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs3

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.