Iranian Cyber Actors Deploy CHOSEN BRICK Malware Against Dissidents

Iranian state cyber actors are actively deploying a malware called CHOSEN BRICK against individuals perceived as threats to the regime. This campaign has been reported by three Western intelligence agencies, including the UK's National Cyber Security Centre, the FBI, and the Netherlands' AIVD. The targeted groups include dissidents, activists, and journalists in the UK, US, and the Netherlands, with operations dating back to at least 2025.

The malware enables Iranian cyber actors to gather extensive information about a target's contacts, emails, and social media messages, which could facilitate tracking their movements. The advisory highlights that Iranian intelligence services have even plotted to kidnap or conduct lethal operations against individuals they view as enemies of the regime.

The attack typically begins with contact through messaging platforms, primarily WhatsApp and Telegram. The attacker often impersonates someone known to the target or presents themselves as technical support from the messaging service. By building rapport over time, the attacker persuades the target to download and open a malicious file disguised as legitimate software, such as fake versions of popular applications like Norton Antivirus or Adobe Flash Player. In some instances, the malware has been disguised as MRI scan results.

The attackers frequently attempt to compromise the target's work device first. If this approach fails or if the risk of detection is too high, they encourage the target to open the file on a personal device, bypassing workplace security measures. CHOSEN BRICK specifically targets Windows systems, employing tactics to evade detection by Microsoft Defender and ensuring persistence through registry modifications.

Potential for Malware Expansion and Surveillance

While the malware has thus far remained confined to individual devices, its capability to download and install additional malware raises concerns about potential further spread. Communication between the malware and its operators occurs via Telegram, with each infected device assigned a unique bot, complicating efforts to trace connections between victims.

The malware's functionalities are extensive, allowing it to log running processes, capture screenshots, activate the microphone, extract data from browsers, steal emails, delete files, and even wipe the device entirely. Screen capture is particularly noted as a common method for gathering information about a victim's contacts and daily routines, with some of this data reportedly appearing on pro-Iranian leak sites.

Intelligence Reviewed

Given the campaign's focus on both personal and work devices, the agencies recommend that organizations share this advisory with staff who may be at risk, urging them to check their personal devices for potential infections. Organizations concerned about the execution of CHOSEN BRICK are advised to consult their IT providers for further investigation.

In recent months, Western governments have issued multiple warnings regarding Iranian cyber activities, especially following military actions involving the US and Israel against Iran. Notably, Iranian hackers were implicated in a cyberattack that shut down a British power plant for four days in August, and US agencies have reported increased Iranian cyber activity targeting critical infrastructure such as energy and water networks.