Iranian Hackers Deploy CHOSEN BRICK Malware for Espionage
Government agencies are alerting the public to the activities of Iranian state-linked hackers who are employing a Windows malware strain named CHOSEN BRICK. This malware is specifically designed to target dissidents, activists, and journalists worldwide, raising significant concerns about privacy and security.
CHOSEN BRICK possesses capabilities for data theft and espionage, allowing it to collect sensitive information from various communication platforms, including email, Telegram, and WhatsApp. It can also take screenshots and record audio, making it a potent tool for surveillance.
The primary targets of these attacks have been individuals located in the United States, United Kingdom, and the Netherlands. Cybersecurity agencies from these countries have collaborated with the FBI to publish a joint advisory regarding the threat posed by this malware.
Typically, an attack begins with social engineering tactics, where the hackers impersonate trusted contacts or technical support personnel. These deceptive messages are often sent via WhatsApp or Telegram, tricking victims into opening malicious files disguised as legitimate applications such as Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, or KeePass. The attackers frequently suggest that victims launch these applications on personal devices to circumvent corporate security measures.
In some instances, the hackers have even utilized medical-related lures to entice victims. Once the malicious application is executed, it installs CHOSEN BRICK in the background while maintaining a convincing interface that aligns with the lure.
To evade detection, the malware modifies Windows Registry Run keys and adds exclusions to Microsoft Defender. It connects to a unique Telegram bot that corresponds with the victim's ID, facilitating command-and-control operations.
Methods of Data Exfiltration and Targeting
The stolen data is exfiltrated through Telegram or cloud services such as VultrObjects and StorjShare. Newer variants of CHOSEN BRICK are capable of routing traffic through SOCKS5 proxies to further conceal their activities. The advisory notes that the compromised data often appears on pro-Iranian leak sites, which serves to harass victims and heightens the physical risks faced by dissidents abroad.
Government agencies assert that Iran likely employs cyber activities to suppress individuals perceived as threats to the regime, including dissidents, activists, and journalists. There have been instances where Iranian intelligence services have allegedly plotted to kidnap or carry out lethal operations against such individuals internationally.
Potential victims and organizations are advised to scrutinize their Registry Run entries for any suspicious entries and to examine logs for indicators of compromise (IoCs) as outlined in the advisory. Unexpected connections to Telegram’s API, Backblaze B2, VultrObjects, StorjShare, IPRoyal, and LightningProxies should be treated with suspicion.
Final Assessment
As the threat landscape continues to evolve, it is crucial for individuals and organizations to remain vigilant against such cyber threats. The use of sophisticated malware like CHOSEN BRICK highlights the need for robust cybersecurity measures and awareness of potential social engineering tactics employed by malicious actors.
In conclusion, the emergence of CHOSEN BRICK malware underscores the ongoing risks posed by state-sponsored cyber activities. Individuals, particularly those in vulnerable positions, must take proactive steps to safeguard their digital communications and personal information against these threats.
