Chosen Brick, Iran’s Surveillance Malware
UK, US, and Dutch agencies warn Iranian CHOSEN BRICK malware targets dissidents and journalists via Telegram, harvesting contacts, emails, and messages since 2025.
The UK NCSC, FBI, and Dutch AIVD jointly attributed the CHOSEN BRICK Windows malware family to Iranian intelligence services, used since at least 2025 against dissidents, journalists, and activists worldwide, including in the UK, US, and Netherlands. Operators build rapport over WhatsApp or Telegram, impersonating known contacts or platform support, then deliver lures disguised as installers for Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, or KeePass, or fake MRI results. The malware persists via registry Run keys, adds Microsoft Defender exclusions, and uses per-victim Telegram bot IDs for C2, with newer versions adding HTTPS or SOCKS5 proxies. Some victims' data appeared on pro-Iranian leak sites, raising harassment and physical-safety risks.
- Joint advisory from NCSC, FBI, and AIVD names CHOSEN BRICK
- Malware targeted dissidents, journalists, and activists since at least 2025
- Delivery relies on rapport-building over WhatsApp and Telegram with tailored lures
- Persistence via registry Run key; Defender exclusions; Telegram bot C2
- Victim data appeared on pro-Iranian leak sites, raising physical threat risks
- ATT&CK
- T1566.003 Spearphishing via ServiceT1589 Gather Victim Identity InformationT1547.001 Registry Run Keys / Startup FolderT1562.001 Impair Defenses: Disable or Modify Tools
- Vendors
- Microsoft
- Threat actors
- Iranian intelligence services
- Malware
- CHOSEN BRICK
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | backblazeb2.com | how up unexpectedly in DNS or proxy logs: api.telegram.org, backblazeb2.com, vultrobjects.com, storjshare.io, iproyal.com, and lightnin |
| domain | iproyal.com | gram.org, backblazeb2.com, vultrobjects.com, storjshare.io, iproyal.com, and lightningproxies.net. None of these are malicious on t |
| domain | lightningproxies.net | zeb2.com, vultrobjects.com, storjshare.io, iproyal.com, and lightningproxies.net. None of these are malicious on their own, which is exactly |
| domain | vultrobjects.com | ly in DNS or proxy logs: api.telegram.org, backblazeb2.com, vultrobjects.com, storjshare.io, iproyal.com, and lightningproxies.net. None |
From the original article
6 min read at securityaffairs.com
UK, US, and Dutch agencies expose Chosen Brick, Iranian malware used to track and harass dissidents, journalists, and activists via Telegram. The UK, the US, and the Netherlands published a joint advisory warning about a Windows malware family, dubbed Chosen Brick, that Iran’s intelligence services use to track down dissidents, journalists, and activists, and the […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.