Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’
UK, US, and Dutch agencies expose CHOSEN BRICK spyware used by Iranian MOIS hackers to surveil dissidents, journalists, and activists via fake MRI lures.
The UK NCSC, FBI, and Dutch AIVD jointly warned that Iranian state-sponsored hackers deploy CHOSEN BRICK Windows spyware against dissidents, activists, and journalists since at least 2025. Operators build rapport over WhatsApp and Telegram, often posing as known contacts or tech support, then deliver malicious files disguised as an MRI scan or installers for Pictory, RunwayML, Norton, Telegram, Adobe Flash Player, and KeePass. The malware steals contacts, emails, and social media messages, captures screen content and microphone audio, adds Microsoft Defender exclusions, and uses per-victim Telegram bots for command and control. The FBI attributes the tradecraft to Iran's Ministry of Intelligence and Security, including the 'Handala Hack' persona, and stolen data has surfaced on pro-Iranian leak sites.
- CHOSEN BRICK Windows spyware targets regime critics in UK, US, Netherlands since 2025
- Lures include fake MRI scans and impersonated Norton, KeePass, Telegram, RunwayML installers
- Malware steals contacts and messages, records microphone, uses per-victim Telegram C2 bots
- FBI attributes activity to Iran MOIS, linked to Handala Hack and Homeland Justice
- Stolen data feeds pattern-of-life profiling, raising physical risks to targeted individuals
From the original article
3 min read at therecord.mediaAccording to the United Kingdom’s National Cyber Security Centre (NCSC), Iran has used this and similar cyber activity to “support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists.”
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.