Cybersecurity and intelligence bodies from the United States, United Kingdom, and the Netherlands have jointly issued an alert regarding a sophisticated Windows-based malware known as Chosen Brick. This malware, linked to Iranian state-backed cyber operatives, specifically targets dissidents, activists, and journalists on a global scale.
Background and Modus Operandi
Since at least 2025, Chosen Brick has been utilized by Iranian entities to gather extensive personal data, including contacts, emails, and social media interactions. This information aids in tracking individuals’ movements and behavioral patterns, supporting state-led repression efforts. Occasionally, the stolen data is leaked on pro-Iranian platforms to further intimidate the targets.
The infiltration process typically starts on messaging applications such as WhatsApp and Telegram. Cybercriminals gather intelligence on their targets to create a sense of trust, often masquerading as friends or technical support personnel, eventually delivering malicious files.
Techniques and Strategies
The attackers primarily target corporate devices. If initial attempts are blocked by security protocols, the attackers shift engagements to personal devices to circumvent these defenses. To deceive the victims, the malware is disguised as legitimate utility programs or falsified medical documents, such as MRI results. Once opened, the files display a decoy interface while installing the malware covertly.
Chosen Brick infections are exclusive to Windows systems. Upon activation, it ensures persistence through registry modifications and attempts to bypass local security measures by manipulating Microsoft Defender settings.
Command-and-Control and Impact
For maintaining control, the malware assigns a unique Telegram bot ID to each compromised device, ensuring operational security and preventing cross-victim data leaks. Data exfiltration is conducted via Telegram and cloud storage services.
In a separate report, the FBI has detailed the use of Telegram by Iranian hackers for command-and-control operations. Chosen Brick offers robust surveillance capabilities, such as capturing screenshots, recording audio, extracting chat data, and executing destructive commands.
Despite lacking automated lateral movement, the malware can download additional payloads, enabling expanded access through manual intervention.
As global cybersecurity threats evolve, the exposure of Chosen Brick underscores the need for enhanced vigilance and robust security measures to protect against state-sponsored cyber threats.
