Iranian CHOSEN BRICK malware targets dissidents

15 September 2026 routine threat medianon-profit

NCSC, FBI and AIVD detail CHOSEN BRICK, Iranian state malware used via social-engineering lures on WhatsApp/Telegram to spy on dissidents, activists and journalists.

A joint advisory from the UK NCSC, US FBI and Dutch AIVD details CHOSEN BRICK, a Windows-targeting malware family used by Iranian state cyber actors since at least 2025 against dissidents, activists and journalists in the UK, US and Netherlands. Victims are approached via social messaging platforms (WhatsApp, Telegram) where the actor builds rapport by posing as a trusted contact or platform support, then convinces the target to open a malicious file disguised as legitimate software (e.g. fake Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, KeePass installers, or fake MRI scan results). If corporate defenses block delivery, the actor pivots to the target's personal device.

Once executed, CHOSEN BRICK establishes persistence via the HKCU Run registry key, adds Defender exclusions to evade detection, and communicates with a unique Telegram bot per victim for C2, sometimes proxied via HTTPS/SOCKS5 to obscure traffic. Capabilities include process/system enumeration, screen capture, microphone recording, theft of Telegram/WhatsApp browser data and email content, arbitrary file download/delete, and a wiper function. Stolen data—used to profile a victim's contacts, location and pattern of life—has in some cases been published on pro-Iranian leak sites, increasing physical safety risk given Iran's history of transnational repression, including plots against perceived regime enemies. Exfiltration uses the Telegram bot plus cloud object storage (VultrObjects, StorjShare). No automated lateral movement has been observed, though the malware can download further payloads.

Defenders should hunt for the specified Run-key persistence entries, unexpected connections to the listed domains, and unusual staging files in non-standard paths like a spaced 'C:\Windows \SysWOW64'. Because targeting extends to personal devices, organisations are advised to brief at-risk staff and support them in checking personal devices, alongside standard technical mitigations (phishing-resistant MFA, application allowlisting, endpoint/network monitoring, SmartScreen enforcement).

Mentioned in this report

Threat actors Iran-nexus activity (unattributed)

Malware CHOSEN BRICK

Detection guidance

CHOSEN BRICK Persistence via Registry Run Key

ATT&CK T1547.001

Detection of suspicious registry Run key modifications commonly associated with CHOSEN BRICK malware persistence mechanism. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: CHOSEN BRICK Persistence via Registry Run Key
description: Detects creation or modification of HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  registry keys with suspicious executable paths. CHOSEN BRICK establishes persistence
  via this mechanism.
tags:
- attack.persistence
- attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|startswith: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    Details|contains:
    - .exe
    - .scr
    - .pif
    - .com
  filter_legitimate_windows:
    Details|startswith:
    - C:\\Program Files
    - C:\\Program Files (x86)
    - C:\\Windows\\System32
    - C:\\Windows\\SysWOW64
  filter_known_software:
    Details|contains:
    - OneDrive
    - Windows Defender
    - SecurityHealth
  condition: selection and not filter_legitimate_windows and not filter_known_software
falsepositives:
- Legitimate software installers adding Run keys during installation
- User-installed applications with startup entries
level: high
id: 13d81b88-ce2b-5876-bbc7-f03d004f2d60
status: experimental
author: Vorant

Suspicious Non-Standard Windows Directory Staging

ATT&CK T1036.004

Detection of file creation in obfuscated Windows system paths like 'C:\Windows ' (with trailing space) used by CHOSEN BRICK for staging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Non-Standard Windows Directory Staging
description: Detects file writes to obfuscated Windows paths with trailing spaces
  (e.g. 'C:\\Windows ' instead of 'C:\\Windows') or other non-standard variations.
  CHOSEN BRICK stages malware in such paths to evade basic detection.
tags:
- attack.defense-evasion
- attack.t1036.004
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|re: ^[A-Za-z]:\\Windows\s+\\
  condition: selection
falsepositives:
- Rare legitimate tools using path obfuscation
level: high
id: 0b3e5230-1fe7-50f8-adf6-7fa66bfc12ae
status: experimental
author: Vorant

Malware C2 Communication via Telegram Bot API

ATT&CK T1102.002

Detection of process network connections to Telegram Bot API endpoints indicative of CHOSEN BRICK C2 beaconing. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Malware C2 Communication via Telegram Bot API
description: Detects outbound HTTPS connections to Telegram Bot API endpoints (api.telegram.org)
  from suspicious child processes. CHOSEN BRICK uses Telegram bots for bidirectional
  C2 communication.
tags:
- attack.command-and-control
- attack.t1102.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|endswith: api.telegram.org
    DestinationPort: 443
    Image|endswith:
    - .exe
  filter_legitimate_telegram:
    Image|endswith:
    - \\Telegram.exe
    - \\telegram.exe
  filter_browsers:
    Image|endswith:
    - \\chrome.exe
    - \\firefox.exe
    - \\iexplore.exe
    - \\msedge.exe
  condition: selection and not filter_legitimate_telegram and not filter_browsers
falsepositives:
- Legitimate Telegram client process making API calls
- Automation tools using Telegram Bot API for notification
level: medium
id: 944df48e-600f-5137-a481-c6d8b8edf7e6
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free