US, UK and Dutch agencies detail CHOSEN BRICK malware used against dissidents and journalists

Cybersecurity agencies in the United States, the United Kingdom and the Netherlands, together with the FBI, have published a joint advisory describing a Windows malware family called CHOSEN BRICK. The agencies attribute its use to Iranian state-linked operators and say the targeting is of dissidents, activists and journalists worldwide [1][2].

The implant is built for personal surveillance. According to the advisory as reported, it collects email, Telegram and WhatsApp communications, captures screenshots, and can activate the microphone to record audio [1][2]. Command and control runs through Telegram: each victim is paired with a distinct Telegram bot matching the victim ID, which the operators use to issue instructions and retrieve data [1][2].

The agencies place this activity in the context of transnational repression. Stolen material has in some cases appeared on pro-Iranian leak sites, which the advisory frames as harassment that raises the physical risk to dissidents abroad [1]. The advisory also notes that Iranian intelligence services have previously plotted kidnappings or lethal operations against people internationally whom the regime treats as enemies [1].

Who is affected

The reported targeting is primarily against individuals in the US, UK and the Netherlands — the three countries whose agencies co-signed the advisory [1]. The victim profile described is individual: people who are politically exposed, and the devices they use day to day. The advisory does not limit its guidance to individuals, though; it addresses hunting advice to potential victims and to organisations [1].

That matters for defenders, because the operators deliberately push targets away from managed environments. The lures often suggest running the file on a personal device on the grounds that corporate security controls would block it [1]. Any organisation employing journalists, researchers or campaigners with an Iran nexus should assume the personal side of that person’s computing is in scope as well as the corporate fleet.

How the intrusion starts

Access is social, not technical. There is no vulnerability or exploit named in the reporting — the operators send messages over WhatsApp or Telegram while impersonating a trusted contact or a technical support agent, and persuade the target to open a file [1].

The files are disguised as legitimate applications. Named examples include Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass [1]. Some campaigns used medical pretexts instead, including an MRI scan document used as a lure [1].

When the file runs, it shows an interface consistent with whatever the lure promised, so the target sees the application they expected while the implant installs in the background [1]. Persistence is established through Windows Registry Run keys, and the malware adds Microsoft Defender exclusions to reduce the chance of detection [1].

Exfiltration is deliberately blended with ordinary traffic. Data leaves over Telegram or via cloud services including VultrObjects and StorjShare, and newer variants route traffic through SOCKS5 proxies to conceal the activity [1]. The advisory’s hunting guidance also flags unexpected connections to the Telegram API, Backblaze B2, IPRoyal and LightningProxies as worth investigating [1].

One caveat on the technical detail: the capability list published by BleepingComputer is only partially legible in the source we have, with a single item — downloading additional payloads into a SysWOW64 path — surviving intact [1]. Treat the capability summary above as the reported subset, not an exhaustive inventory, and read the original advisory for the full list and for indicators of compromise.

On attribution: The Hacker News reports the agencies attribute the malware to Iran’s intelligence service, without naming which one [2]; BleepingComputer and The Register describe the operators as Iranian state-linked or Iranian spies [1][3]. None of the sources gives a tracked group name, so we are not assigning one.

What to do

• If you are a likely target — a journalist, activist or dissident with an Iran nexus — treat unsolicited software recommendations over WhatsApp or Telegram as hostile by default, including from contacts you recognise. Verify out of band before running anything.
• Never accept the advice to move an installation to a personal device because a work machine blocks it. That instruction is itself a strong indicator of the campaign described in the advisory [1].
• Pull the indicators of compromise from the joint advisory and search your logs for them, rather than relying on the partial detail in press coverage [1].
• Inspect Windows Registry Run keys on at-risk machines for entries you cannot account for, and audit Microsoft Defender exclusion lists — the implant adds its own [1].
• Alert on unexpected outbound connections to the Telegram API, Backblaze B2, VultrObjects, StorjShare, IPRoyal and LightningProxies from endpoints that have no business reaching them [1].
• Install applications only from the vendor’s own site or a platform app store, and be sceptical of any installer for software the vendor no longer distributes. The lures in this campaign imitated well-known application names [1].
• For high-risk individuals, assume compromise means physical risk, not just data loss, given the reported leak-site publication [1]. Involve the relevant national agency or a civil-society incident response service rather than handling it alone.