Iranian hackers use CHOSEN BRICK Windows malware to spy on targets
Iranian state-linked hackers use CHOSEN BRICK Windows malware, spread via Telegram and WhatsApp social engineering, to spy on dissidents and journalists worldwide.
US, UK, and Dutch cyber agencies with the FBI issued a joint advisory on Iranian state-linked hackers deploying a Windows malware strain called CHOSEN BRICK against dissidents, activists, and journalists, primarily in the US, UK, and Netherlands. Attacks begin with messages on WhatsApp or Telegram impersonating trusted contacts or technical support, tricking victims into running malicious files disguised as apps such as Pictory, RunwayML, Norton Antivirus, Telegram, and KeePass. The malware persists via Registry Run keys, adds Microsoft Defender exclusions, and uses a per-victim Telegram bot for command-and-control while stealing email, Telegram and WhatsApp data, screenshots, and audio. Stolen data is exfiltrated via Telegram or cloud services like VultrObjects and StorjShare, and sometimes appears on pro-Iranian leak sites, increasing physical risk for dissidents abroad.
- CHOSEN BRICK collects email, Telegram/WhatsApp data, screenshots, and microphone audio
- Lures impersonate apps like Pictory, RunwayML, Norton, Telegram, and KeePass
- Malware persists via Registry Run keys and adds Microsoft Defender exclusions
- Stolen data sometimes surfaces on pro-Iranian leak sites as harassment
- Defenders should check Run keys and watch for Telegram, Backblaze, Vultr, Storj connections
- ATT&CK
- T1566.003 Spearphishing via ServiceT1204.002 Malicious FileT1547.001 Registry Run Keys / Startup FolderT1562.001 Impair DefensesT1113 Screen Capture
- Vendors
- Microsoft
- Threat actors
- Iranian state-linked hackers
- Malware
- CHOSEN BRICK
From the original article
2 min read at bleepingcomputer.com
Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.