Iran uses CHOSEN BRICK spyware on dissidents
NCSC, FBI and AIVD warn Iranian state actors use spear-phishing and CHOSEN BRICK spyware to surveil dissidents, activists and journalists.
Sourcencsc.gov.uk — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The UK NCSC, US FBI and Dutch AIVD have jointly published an advisory detailing an Iranian state-sponsored spyware campaign targeting dissidents, activists and journalists worldwide, including in the UK. The threat actors impersonate trusted contacts over messaging platforms such as WhatsApp and Telegram, building rapport with targets over time before delivering a Windows-based spyware implant dubbed CHOSEN BRICK. Social engineering lures are tailored to victims' personal interests or circumstances, including fabricated documents such as fake MRI test results, to increase click-through likelihood.
CHOSEN BRICK, once installed, is persistent (survives reboot) and provides attackers with access to contacts, emails and social media messages, screen capture capability, and microphone access — enabling comprehensive surveillance of a target's communications and physical environment. Stolen data has subsequently appeared on pro-Iranian leak sites, which the agencies assess increases physical safety risk to victims consistent with a pattern of transnational repression.
The advisory targets Windows systems specifically. Defenders and at-risk individuals are urged to review the joint advisory's mitigation guidance, be alert to unsolicited or unusual contact via messaging apps even from apparent known contacts, and consider NCSC's free cyber defence services for high-risk individuals. The FBI has released a companion technical analysis via IC3 for deeper indicators and detection guidance.
Mentioned in this report
Detection guidance
Spyware Establishing Persistence via Autostart Registry
A behavioural hunt for the technique in general.
Detects processes writing to Run or RunOnce registry keys — common persistence mechanism for spyware like CHOSEN BRICK to survive reboot. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Spyware Establishing Persistence via Autostart Registry
description: Detects writes to Windows autostart registry keys (Run, RunOnce) by suspicious
processes. CHOSEN BRICK and similar spyware use these keys to re-execute on reboot.
Generalises on the registry target pattern, not campaign-specific paths.
tags:
- attack.persistence
- attack.t1547
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|re: HKEY_.*\\Software\\(Wow6432Node\\)?Microsoft\\Windows\\CurrentVersion\\Run(Once)?$
filter_legitimate:
Image|re: (\\(msiexec|installer|rundll32|wscript|cscript|powershell|mshta|regsvcs|regasm)\.exe|svchost\.exe)$
condition: selection and not filter_legitimate
falsepositives:
- Software installers or updates writing legitimate startup entries
- Administrative tools configuring scheduled startups
level: medium
id: 0f6bc335-62ae-5283-a97e-a22a9b9a39fa
status: experimental
author: Vorant
Process Capturing Screen or Audio for Exfiltration
A behavioural hunt for the technique in general.
Detects common screen/audio capture API calls or command-line tools used by spyware to collect surveillance data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Capturing Screen or Audio for Exfiltration
description: Detects processes invoking screen capture or audio capture via common
APIs or utilities. CHOSEN BRICK uses these capabilities to monitor targets' screen
and microphone. Rule targets distinctive tool and API patterns, not victim-specific
filenames.
tags:
- attack.collection
- attack.t1113
- attack.t1123
logsource:
category: process_creation
product: windows
detection:
selection_screencapture:
CommandLine|contains:
- nircmd.exe screencapture
- ffmpeg.exe -f gdigrab
- ffmpeg.exe -f dshow
selection_audio:
CommandLine|contains:
- nircmd.exe mute
- ffmpeg.exe -f dshow -i audio
- wmic.exe path Win32_SoundDevice
filter_admin:
User|contains: SYSTEM
condition: (selection_screencapture or selection_audio) and not filter_admin
falsepositives:
- Legitimate screen recording or audio tools launched by users
- IT support or remote-access tools performing diagnostics
level: medium
id: 3f00f4f7-78b7-5bb4-a0bb-661231376206
status: experimental
author: Vorant
Staged Data Exfiltration Over Web Service
A behavioural hunt for the technique in general.
Detects suspicious processes making outbound HTTPS connections to upload staged data — behavior consistent with spyware exfiltrating surveillance captures and messages. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Staged Data Exfiltration Over Web Service
description: Detects processes initiating outbound HTTPS connections from unexpected
binaries, indicative of spyware exfiltrating staged data (screen captures, audio,
messages). Focuses on suspicious child process making HTTP POST/PUT to remote servers,
not specific C2 domains.
tags:
- attack.exfiltration
- attack.t1567
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 443
Protocol: tcp
Image|endswith:
- \\rundll32.exe
- \\svchost.exe
- \\wscript.exe
- \\cscript.exe
filter_legitimate:
DestinationHostname|endswith:
- .microsoft.com
- .windows.com
- .apple.com
- .google.com
condition: selection and not filter_legitimate
falsepositives:
- Legitimate Windows updates or cloud sync services
- Antivirus or security software phoning home
level: medium
id: cbd9fa2a-a6b7-55ea-96f5-33f4dadf9be4
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ncsc.gov.uk/news/uk-allies-expose-spyware-iranian-state-actors-target-dissidents-activists-journalists
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs