NCSC and Allies Warn of Iranian Spyware Campaign
NCSC, FBI and AIVD warn Iranian-backed actors deliver Chosen Brick spyware to regime critics via social engineering; stolen data has surfaced on pro-Iranian leak sites.
NCSC, the FBI and the Netherlands' AIVD published a joint advisory warning that a Tehran-backed campaign, active since at least 2025, targets dissidents, activists and journalists with Chosen Brick spyware. The malware persists via Windows registry keys, adds Microsoft Defender exclusions, uses Telegram for C2, and captures screens, audio, emails and Telegram or WhatsApp messages. Stolen data has surfaced on pro-Iranian leak sites in some cases, raising risks to victims' personal safety.
- Delivery relies on social media rapport-building, impersonating contacts or support staff to push malicious app and file downloads.
- Spyware offers process enumeration, screen capture, microphone access, data theft, file deletion and system wiping capabilities.
- Advisory recommends automatic updates, trusted AV, phishing-resistant MFA, app allowlisting and endpoint and network monitoring.
- Because it touches legitimate web services, the spyware likely appears in corporate DNS and web proxy logs.
- ATT&CK
- T1566 PhishingT1204.002 User Execution: Malicious FileT1547.001 Registry Run Keys / Startup FolderT1562.001 Impair Defenses: Disable or Modify ToolsT1113 Screen Capture
- Products
- Microsoft DefenderTelegram
- Threat actors
- Iran
- Malware
- Chosen Brick
- Countries
- IranUnited KingdomNetherlands
From the original article
2 min read at infosecurity-magazine.com
The UK’s National Cyber Security Centre says Iranian Chosen Brick spyware is designed to snoop on dissidents
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.