Government Agencies Warn of Iranian Hackers Using CHOSEN BRICK to Spy on Dissidents
Summary
A joint government advisory warns that Iranian state-linked hackers use CHOSEN BRICK malware, delivered through WhatsApp and Telegram lures, to steal communications, screenshots, and audio from dissidents, activists, and journalists.
Key points
- The advisory says targets included dissidents, activists, and journalists, particularly in the U.S., U.K., and the Netherlands.
- Attackers use impersonation messages on WhatsApp or Telegram to trick targets into opening malicious files disguised as legitimate applications.
- The lures display convincing interfaces while installing CHOSEN BRICK, which persists through Windows Registry Run keys and adds Microsoft Defender exclusions.
- The malware can collect system information, capture screenshots, record audio, steal email and messaging data, download payloads, delete files, or wipe a host.
- Stolen data is sent through Telegram or cloud services; newer variants reportedly route traffic through SOCKS5 proxies.
- The advisory says stolen data may appear on pro-Iranian leak sites, potentially increasing risks to dissidents abroad.
- Potential victims and organizations are advised to inspect suspicious Registry Run entries and investigate unexpected connections to services named in the advisory.
Article Details
- Event Type
- Government advisory about Iranian state-linked hackers using CHOSEN BRICK malware for cyber espionage.
- Impact
- CHOSEN BRICK steals communications, captures screenshots, records audio, and can download payloads, delete files, or wipe a host. Stolen data may be exposed on pro-Iranian leak sites, increasing risks to targeted dissidents, activists, and journalists.
MITRE ATT&CK
T1057 · Process DiscoveryThe malware enumerates running processes.T1082 · System Information DiscoveryThe malware collects system information.T1105 · Ingress Tool TransferThe malware can download additional payloads.T1113 · Screen CaptureThe malware captures screenshots.T1123 · Audio CaptureThe malware records audio through the microphone.T1547.001 · Registry Run Keys / Startup FolderThe malware establishes persistence through Windows Registry Run keys.T1567.002 · Exfiltration to Cloud StorageStolen data is exfiltrated through cloud services.
Malware
Products
Adobe Flash PlayerFake apps like Norton Antivirus and Adobe Flash Player are used to deliver the malware.KeePassas legitimate applications (e.g., Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, KeePass), often suggesting they launch them on personal devices to bypass corporate security blocks.Microsoft Defender Antimalware PlatformThe malware adds Microsoft Defender exclusions to evade detection and connects to a unique Telegram bot that matches the victim’s ID and provides command-and-control (C2).Microsoft WindowsThe malware is spread through social engineering on WhatsApp and Telegram, hides with Windows persistence, and sends stolen data through Telegram and cloud services.Norton AntivirusFake apps like Norton Antivirus and Adobe Flash Player are used to deliver the malware.PictoryThe threat actor tricks victims into opening malicious files disguised as legitimate applications (e.g., Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, KeePass), often suggesting they launch them onRunwayMLactor tricks victims into opening malicious files disguised as legitimate applications (e.g., Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, KeePass), often suggesting they launch them on personalTelegramThe malware is spread through social engineering on WhatsApp and Telegram, hides with Windows persistence, and sends stolen data through Telegram and cloud services.WhatsAppThe malware is spread through social engineering on WhatsApp and Telegram, hides with Windows persistence, and sends stolen data through Telegram and cloud services.
Countries
Iran“Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists,” the government agencies say.NetherlandsThe threat actor primarily targeted individuals in the U.S., U.K., and the Netherlands, whose cybersecurity agencies published a joint advisory with the FBI.