Iranian Hackers Use Fake MRI Results to Infect Victims With CHOSEN BRICK Spyware
Iranian state-linked hackers deliver CHOSEN BRICK Windows spyware via fake MRI results to surveil dissidents, activists, and journalists in the UK, US, and Netherlands.
A joint advisory from the UK NCSC, FBI, and the Netherlands' AIVD links Iranian state-linked actors to CHOSEN BRICK, a Windows spyware family used for long-term surveillance since at least 2025. Targets are approached on WhatsApp or Telegram with tailored lures such as fake MRI scan results or application files, and operators often redirect victims to personal devices to bypass corporate controls. The malware persists via Run registry keys, adds antivirus exclusions, uses a per-victim Telegram bot for command and control, and exfiltrates data through cloud storage and proxy services. Capabilities include screenshots, audio recording, email and messaging theft, command execution, file deletion, data wiping, and some victims' details have appeared on pro-Iranian leak sites for harassment.
- NCSC, FBI, and AIVD jointly tied CHOSEN BRICK to Iranian state-linked espionage
- Victims are contacted on WhatsApp or Telegram and sent fake MRI results or app files
- Malware persists via Run registry keys and adds antivirus exclusions to evade detection
- Per-victim Telegram bots provide C2; data leaves via cloud storage and proxy services
- Capabilities include screenshots, audio recording, message theft, command execution, and data wiping
- ATT&CK
- T1566.003 Spearphishing via ServiceT1547.001 Registry Run Keys / Startup FolderT1562.001 Impair DefensesT1113 Screen CaptureT1102 Web Service
- Threat actors
- Iran
- Malware
- CHOSEN BRICK
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | api.telegram.org | a space after Windows , used for additional payloads Domain api[.]telegram[.]org Telegram service domain that should be investigated whe |
| domain | backblazeb2.com | e domain that should be investigated when unexpected Domain backblazeb2[.]com Cloud-storage domain identified for investigation Domain |
| domain | iproyal.com | io Cloud-storage domain identified for investigation Domain iproyal[.]com Proxy-service domain identified for investigation Domain |
| domain | lightningproxies.net | om Proxy-service domain identified for investigation Domain lightningproxies[.]net Proxy-service domain identified for investigation Note: I |
| domain | storjshare.io | d object-storage domain identified for investigation Domain storjshare[.]io Cloud-storage domain identified for investigation Domain |
| domain | vultrobjects.com | om Cloud-storage domain identified for investigation Domain vultrobjects[.]com Cloud object-storage domain identified for investigation |
From the original article
4 min read at cybersecuritynews.com
Iranian state-linked hackers are using fake MRI scan results to infect selected people with CHOSEN BRICK, a Windows spyware family built for long-term surveillance. The campaign has targeted individuals in the United Kingdom, United States and Netherlands since at least 2025, with dissidents, activists and journalists facing particular risk. The advisory describes a focused espionage […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.