US, UK and Dutch Agencies Warn of Iranian Chosen Brick Surveillance Malware

Summary

US, UK and Dutch agencies say Iranian state actors use Chosen Brick to surveil dissidents, activists and journalists, delivering it through messaging platforms and disguising it as legitimate software or medical files.

Key points

The agencies say the Windows malware has been active since at least 2025 and targets dissidents, activists and journalists worldwide.
Operators reportedly build trust through WhatsApp or Telegram, then deliver disguised installers or fake medical documents.
Chosen Brick establishes persistence through registry Run keys and attempts to evade Microsoft Defender by adding exclusions.
The malware uses unique Telegram bot IDs for infected endpoints and exfiltrates data through Telegram infrastructure and cloud storage.
Capabilities include capturing screenshots and microphone audio, stealing emails and browser-stored chat data, deploying additional payloads, and wiping data.
The agencies say stolen personal information has sometimes appeared on pro-Iranian leak sites to harass targets.

Article Details

Event Type: Joint advisory by US, UK, and Dutch agencies warning about Chosen Brick, a Windows surveillance malware family used by Iranian state cyber actors.
Impact: Chosen Brick targets dissidents, activists, and journalists to collect personal data, including contacts, emails, social media messages, screenshots, audio, and browser-stored chat data. Operators can deploy secondary payloads and wipe data; stolen information is sometimes posted to pro-Iranian leak sites to harass targets.

MITRE ATT&CK

T1041 · Exfiltration Over C2 ChannelData exfiltration occurs through Telegram infrastructure and cloud storage services.T1056.001 · KeyloggingThe malware extracts browser-stored chat data.T1059 · Command and Scripting InterpreterThe malware can execute commands, including commands to wipe data.T1105 · Ingress Tool TransferChosen Brick can download secondary malware payloads.T1113 · Screen CaptureOperators can capture screenshots from infected endpoints.T1123 · Audio CaptureOperators can record host audio through the microphone.T1485 · Data DestructionOperators can execute commands to wipe data.T1547.001 · Registry Run Keys / Startup FolderChosen Brick establishes persistence across reboots using Windows Registry Run keys.T1562.001 · Disable or Modify ToolsOperators attempt to evade local security tools by adding exclusions in Microsoft Defender.T1566 · PhishingOperators use social engineering and weaponized files to deliver the malware.

Malware

CHOSEN BRICKin the US, UK, and Netherlands have issued a joint advisory warning of a Windows malware family dubbed Chosen Brick, deployed by Iranian state cyber actors to target dissidents, activists, and journalists worldwide.

Products

Microsoft Defender Antimalware PlatformUpon execution, Chosen Brick establishes persistence across reboots using registry Run keys and attempts to evade local security tools by adding exclusions in Microsoft Defender.Microsoft Windowsand intelligence agencies in the US, UK, and Netherlands have issued a joint advisory warning of a Windows malware family dubbed Chosen Brick, deployed by Iranian state cyber actors to target dissidents,TelegramThe attack chain typically begins on messaging platforms such as WhatsApp and Telegram.WhatsAppThe attack chain typically begins on messaging platforms such as WhatsApp and Telegram.