Iran uses CHOSEN BRICK spyware on dissidents

15 September 2026 routine threat government-nationalmedianon-profit

NCSC, FBI and AIVD warn Iranian state actors use spear-phishing and CHOSEN BRICK spyware to surveil dissidents, activists and journalists.

The UK NCSC, US FBI and Dutch AIVD have jointly published an advisory detailing an Iranian state-sponsored spyware campaign targeting dissidents, activists and journalists worldwide, including in the UK. The threat actors impersonate trusted contacts over messaging platforms such as WhatsApp and Telegram, building rapport with targets over time before delivering a Windows-based spyware implant dubbed CHOSEN BRICK. Social engineering lures are tailored to victims' personal interests or circumstances, including fabricated documents such as fake MRI test results, to increase click-through likelihood.

CHOSEN BRICK, once installed, is persistent (survives reboot) and provides attackers with access to contacts, emails and social media messages, screen capture capability, and microphone access — enabling comprehensive surveillance of a target's communications and physical environment. Stolen data has subsequently appeared on pro-Iranian leak sites, which the agencies assess increases physical safety risk to victims consistent with a pattern of transnational repression.

The advisory targets Windows systems specifically. Defenders and at-risk individuals are urged to review the joint advisory's mitigation guidance, be alert to unsolicited or unusual contact via messaging apps even from apparent known contacts, and consider NCSC's free cyber defence services for high-risk individuals. The FBI has released a companion technical analysis via IC3 for deeper indicators and detection guidance.

Mentioned in this report

Threat actors Iran-nexus activity (unattributed)

Malware CHOSEN BRICK

Detection guidance

Spyware Establishing Persistence via Autostart Registry

ATT&CK T1547

Detects processes writing to Run or RunOnce registry keys — common persistence mechanism for spyware like CHOSEN BRICK to survive reboot. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Spyware Establishing Persistence via Autostart Registry
description: Detects writes to Windows autostart registry keys (Run, RunOnce) by suspicious
  processes. CHOSEN BRICK and similar spyware use these keys to re-execute on reboot.
  Generalises on the registry target pattern, not campaign-specific paths.
tags:
- attack.persistence
- attack.t1547
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|re: HKEY_.*\\Software\\(Wow6432Node\\)?Microsoft\\Windows\\CurrentVersion\\Run(Once)?$
  filter_legitimate:
    Image|re: (\\(msiexec|installer|rundll32|wscript|cscript|powershell|mshta|regsvcs|regasm)\.exe|svchost\.exe)$
  condition: selection and not filter_legitimate
falsepositives:
- Software installers or updates writing legitimate startup entries
- Administrative tools configuring scheduled startups
level: medium
id: 0f6bc335-62ae-5283-a97e-a22a9b9a39fa
status: experimental
author: Vorant

Process Capturing Screen or Audio for Exfiltration

ATT&CK T1113

Detects common screen/audio capture API calls or command-line tools used by spyware to collect surveillance data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Capturing Screen or Audio for Exfiltration
description: Detects processes invoking screen capture or audio capture via common
  APIs or utilities. CHOSEN BRICK uses these capabilities to monitor targets' screen
  and microphone. Rule targets distinctive tool and API patterns, not victim-specific
  filenames.
tags:
- attack.collection
- attack.t1113
- attack.t1123
logsource:
  category: process_creation
  product: windows
detection:
  selection_screencapture:
    CommandLine|contains:
    - nircmd.exe screencapture
    - ffmpeg.exe -f gdigrab
    - ffmpeg.exe -f dshow
  selection_audio:
    CommandLine|contains:
    - nircmd.exe mute
    - ffmpeg.exe -f dshow -i audio
    - wmic.exe path Win32_SoundDevice
  filter_admin:
    User|contains: SYSTEM
  condition: (selection_screencapture or selection_audio) and not filter_admin
falsepositives:
- Legitimate screen recording or audio tools launched by users
- IT support or remote-access tools performing diagnostics
level: medium
id: 3f00f4f7-78b7-5bb4-a0bb-661231376206
status: experimental
author: Vorant

Staged Data Exfiltration Over Web Service

ATT&CK T1567

Detects suspicious processes making outbound HTTPS connections to upload staged data — behavior consistent with spyware exfiltrating surveillance captures and messages. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Staged Data Exfiltration Over Web Service
description: Detects processes initiating outbound HTTPS connections from unexpected
  binaries, indicative of spyware exfiltrating staged data (screen captures, audio,
  messages). Focuses on suspicious child process making HTTP POST/PUT to remote servers,
  not specific C2 domains.
tags:
- attack.exfiltration
- attack.t1567
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 443
    Protocol: tcp
    Image|endswith:
    - \\rundll32.exe
    - \\svchost.exe
    - \\wscript.exe
    - \\cscript.exe
  filter_legitimate:
    DestinationHostname|endswith:
    - .microsoft.com
    - .windows.com
    - .apple.com
    - .google.com
  condition: selection and not filter_legitimate
falsepositives:
- Legitimate Windows updates or cloud sync services
- Antivirus or security software phoning home
level: medium
id: cbd9fa2a-a6b7-55ea-96f5-33f4dadf9be4
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ncsc.gov.uk/news/uk-allies-expose-spyware-iranian-state-actors-target-dissidents-activists-journalists

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free