US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware
US, UK, and Dutch agencies warn Iranian state actors deploy Windows surveillance malware 'Chosen Brick' against dissidents, activists, and journalists worldwide.
Joint advisories from US, UK, and Dutch agencies describe Chosen Brick, a Windows surveillance malware active since at least 2025 and used by Iranian state cyber actors to track regime opponents. The malware harvests contacts, emails, and social media messages, persists via registry Run keys, evades Microsoft Defender, and uses per-victim Telegram bot IDs for command-and-control and exfiltration. Operators build rapport on WhatsApp and Telegram posing as acquaintances or support staff, disguising payloads as utility software or fake medical documents. Capabilities include screenshot capture, audio recording, credential theft, secondary payload delivery, and data wiping.
- Targets Windows, harvesting contacts, emails, chat data, and life-pattern information of regime critics
- Persistence via registry Run keys; adds Microsoft Defender exclusions to evade local security tools
- Each victim gets a unique Telegram bot ID for C2; exfiltration via Telegram and cloud storage
- Victims approached on WhatsApp or Telegram; payloads disguised as utilities or fake MRI results
- Can capture screenshots, record audio, steal emails, deploy secondary payloads, and wipe data
- ATT&CK
- T1566.001 Spearphishing AttachmentT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderT1562.001 Impair Defenses: Disable or Modify ToolsT1071.001 Application Layer Protocol: Web ProtocolsT1567.002 Exfiltration to Cloud Storage
- Vendors
- Microsoft
- Threat actors
- Iranian state cyber actors
- Malware
- Chosen Brick
- Organizations
- FBI
From the original article
2 min read at securityweek.com
US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C. The post US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.