NCSC and Allies Warn of Iranian Spyware Campaign
NCSC, FBI and AIVD warn Iranian-backed actors deliver Chosen Brick spyware to regime critics via social engineering; stolen data has surfaced on pro-Iranian leak sites.
NCSC, the FBI and the Netherlands' AIVD published a joint advisory warning that a Tehran-backed campaign, active since at least 2025, targets dissidents, activists and journalists with Chosen Brick spyware. The malware persists via Windows registry keys, adds Microsoft Defender exclusions, uses Telegram for C2, and captures screens, audio, emails and Telegram or WhatsApp messages. Stolen data has surfaced on pro-Iranian leak sites in some cases, raising risks to victims' personal safety.
- Delivery relies on social media rapport-building, impersonating contacts or support staff to push malicious app and file downloads.
- Spyware offers process enumeration, screen capture, microphone access, data theft, file deletion and system wiping capabilities.
- Advisory recommends automatic updates, trusted AV, phishing-resistant MFA, app allowlisting and endpoint and network monitoring.
- Because it touches legitimate web services, the spyware likely appears in corporate DNS and web proxy logs.
Full article501 words · extracted from infosecurity-magazine.com · click to collapse
The UK and its allies have warned opponents of the Iranian regime that they may be subject to targeting by a Tehran-backed spyware campaign.
An advisory published yesterday by the National Cyber Security Centre (NCSC), the FBI and the Netherlands' General Intelligence and Security Service (AIVD) is designed to help dissidents, activists and journalists critical of the regime.
It warned that, in some cases, information stolen by the spyware has appeared on pro-Iranian leak sites, increasing the risk to victims’ personal safety.
“The details of this cyber campaign reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices,” said NCSC director of operations, Paul Chichester.
“With our international partners, we strongly encourage individuals at risk to familiarize themselves with the social-engineering techniques described in the advisory, and to act on the mitigation advice.”
Read more on Iranian threats: US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks.
The campaign itself revolves around the delivery of Chosen Brick: spyware designed to harvest targets’ contacts, emails and social media messages, to enable tracking of their movements, repression or worse.
The malware itself uses Windows registry keys for persistence and adds exclusions to Microsoft Defender antivirus in order to evade detection, the report revealed.
It connects to Telegram for command & control (C2) and has a wide variety of functionality including enumeration of running processes and system info, screen capture, harvesting Telegram and WhatsApp data from browsers, stealing emails and enabling the device mic for audio capture.
It can also delete files, download additional malware, and wipe the entire system, the NCSC said.
Chosen Brick is delivered via social engineering. The threat actor builds rapport with their victim on social media – usually by impersonating a contact or social messaging technical support. Then they persuade the victim to download a legitimate app (eg Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player) or file (e.g. MRI scan).
Advice for Targets
The advisory urged organizations concerned about infection to contact internal or external IT providers to investigate.
“As this actor targets personal devices, not just corporate devices, organizations are recommended to circulate this with their staff that are likely to be targeted and support them in checking their personal devices too,” it added.
On the plus side, the spyware interacts with numerous legitimate web services, so it’s likely to appear in corporate logs through DNS and web proxy services, the NCSC noted.
Best practice mitigations include:
- Following NCSC advice on staying safe online, such as not clicking on download links or attachments
- Switching on automatic updates for device OS and software
- Enabling trusted AV and ensuring it’s up to date
- Not disabling or ignoring smart screen warnings on file downloads
Network admins should also consider enabling phishing-resistant MFA, managing and protecting device fleets with AV, app allowlisting and other controls, and installing endpoint and network monitoring, the report advised.
The campaign has been running since at least 2025, the NCSC said.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/ncsc-allies-warn-iranian-chosen/