Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results
NCSC, FBI, and AIVD warn Iranian state-linked actors deliver CHOSEN BRICK Windows spyware via fake AI apps, antivirus installers, and MRI-result lures.
A joint advisory from the UK NCSC, FBI, and Dutch AIVD details CHOSEN BRICK (FBI tracking name: HEAVYGRAM), Iranian state-linked Windows spyware targeting dissidents, activists, and journalists worldwide since at least 2025. Lures impersonate Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass, and operators pivot conversations from corporate to personal devices to bypass enterprise controls. The spyware persists via Registry Run keys, adds Microsoft Defender exclusions, uses per-victim Telegram bots for command-and-control, and exfiltrates screenshots, audio, email, and chat data via Telegram and cloud services, with some victim data appearing on pro-Iranian leak sites.
- Lures impersonate Pictory, RunwayML, Norton, Telegram, Adobe Flash Player, and KeePass
- Persistence via HKCU Run key; malware adds Microsoft Defender exclusions
- Per-victim Telegram Bot IDs; HTTPS and SOCKS5 proxies conceal C2 traffic
- Capabilities include screenshots, audio capture, email/chat theft, downloads, and data wiping
- Operators move targets from corporate devices to personal systems to evade EDR
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1547.001 Registry Run Keys / Startup FolderT1562.001 Impair DefensesT1113 Screen Capture
- Vendors
- Microsoft
- Threat actors
- Iran
- Malware
- CHOSEN BRICKHEAVYGRAM
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | api.telegram.org | orjShare. Defenders should investigate unexpected access to api[.]telegram[.]org , backblazeb2[.]com , vultrobjects[.]com , storjshare[. |
| domain | backblazeb2.com | uld investigate unexpected access to api[.]telegram[.]org , backblazeb2[.]com , vultrobjects[.]com , storjshare[.]io , iproyal[.]com an |
| domain | iproyal.com | backblazeb2[.]com , vultrobjects[.]com , storjshare[.]io , iproyal[.]com and lightningproxies[.]net , particularly where such conn |
| domain | lightningproxies.net | , vultrobjects[.]com , storjshare[.]io , iproyal[.]com and lightningproxies[.]net , particularly where such connections do not align with n |
| domain | storjshare.io | .]telegram[.]org , backblazeb2[.]com , vultrobjects[.]com , storjshare[.]io , iproyal[.]com and lightningproxies[.]net , particularly |
| domain | vultrobjects.com | pected access to api[.]telegram[.]org , backblazeb2[.]com , vultrobjects[.]com , storjshare[.]io , iproyal[.]com and lightningproxies[.] |
From the original article
3 min read at gbhackers.com
Iranian state-linked cyber actors are using fake AI applications, antivirus tools and even fabricated MRI scan results to deliver CHOSEN BRICK, a Windows-focused spyware family designed to surveil dissidents, activists and journalists. A joint advisory from the UK National Cyber Security Centre (NCSC), the FBI and the Netherlands’ AIVD warns that the campaign has targeted […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.