Iranian cyber targeting of dissidents, activists and journalists
Iranian state actors deploy CHOSEN BRICK spyware targeting dissidents, activists, and journalists via social engineering on messaging platforms, using Telegram for C2 and exfiltrating data through cloud services. CHOSEN BRICK is Windows-only spyware delivered through social engineering on WhatsApp and Telegram. It persists via HKCU Run registry keys, adds Defender exclusions, and uses unique Telegram Bot IDs per victim for C2. The malware captures screens, audio, emails, and messaging app data. Exfiltration uses Telegram bots, cloud storage services, and HTTPS/SOCKS5 proxies. Victims' personal details have been published on pro-Iranian leak sites.
Detection / Hunteropenrouter
Immediate Actions
- Search endpoint logs for CHOSEN BRICK mutex names and registry persistence indicators
- Block network connections to iproyal.com and lightningproxies.net proxy services
- Review Windows Defender exclusion logs for unauthorized modifications
- Check HKCU Run key for suspicious entries on potentially compromised hosts
Key Takeaways
- Malware active from at least 2025, targeting individuals in UK, US, and Netherlands
- Lure files impersonate Pictory, RunwayML, Norton, Telegram, Adobe Flash Player, KeePass, and MRI results
- Each victim receives a unique Telegram Bot ID for C2, preventing cross-contamination
- Attacker creates non-standard Windows system directory with embedded space for malware deployment
- Mutexes ytyjyujyu and noi672pp434awkc12f used as execution guardrails
Attack Chain
- Initial Access: Social engineering via WhatsApp/Telegram impersonating trusted contacts or platform support
- Execution: Target opens malicious file disguised as legitimate app or document
- Persistence: Malware creates HKCU Run registry key entry to survive reboots
- Defense Evasion: Adds Microsoft Defender exclusions and registers mutexes as guardrails
- C2: Connects to unique Telegram Bot ID per victim for tasking
- Exfiltration: Data exfiltrated via Telegram bot, cloud storage, and HTTPS/SOCKS5 proxies
Affected Systems
- Windows operating system
- WhatsApp users
- Telegram users
- Dissidents, activists, journalists
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Registry persistence, Defender exclusion changes, and process behavior visible to EDR; personal devices may lack coverage. |
| Network Visibility | Medium | Telegram API and cloud storage traffic visible in DNS/proxy logs but blends with legitimate traffic. |
| Detection Difficulty | Hard | C2 via Telegram blends with legitimate traffic; targeted delivery on personal devices evades corporate controls. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Processes creating new entries in HKCU Run key with non-standard executable paths (T1547.001) | Registry modification events with executable paths | Persistence | Medium — legitimate software also uses Run key |
| Processes modifying Windows Defender exclusion lists via command line or registry (T1685) | Defender exclusion change events | Defense Evasion | Low — admin tools rarely add exclusions |
| Network connections to commercial proxy services from hosts not normally using proxies (T1090.002) | DNS and proxy logs for proxy service domains | Command and Control | Medium — some users may use proxies legitimately |
| Processes creating mutexes with random-looking strings as execution guardrails (T1480.002) | Mutex creation events from process telemetry | Defense Evasion | Low — mutex names are distinctive |
Required Log Sources
- EDR process creation logs
- Windows registry event logs
- DNS query logs
- Web proxy logs
- Windows Defender event logs
- PowerShell execution logs
Key Behavioral Indicators
- New HKCU Run key entry pointing to non-standard executable path
- Windows Defender exclusion added by non-admin process
- Directory creation in Windows system path with embedded space
- Mutex creation with unusual random-looking string names
- Non-Telegram process connecting to Telegram API endpoints
- Unexpected connections to commercial proxy service domains
Control Gaps
- Personal devices lacking EDR or endpoint monitoring
- Cloud storage egress not monitored or alerted
- Windows Defender exclusion changes not alerted on
- Social engineering bypasses email security controls
- DNS logging gaps for personal and remote devices
False Positive Assessment
Medium — abuse of legitimate services blends with normal traffic; mutex names and non-standard paths reduce false positives.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enable application allowlisting on managed Windows devices
- Deploy network monitoring for unexpected proxy service and cloud storage connections
- Alert on Windows Defender exclusion modifications by non-admin processes
- Enable phishing-resistant MFA on all user accounts
User Protection
- Ensure antivirus software is enabled and kept up-to-date on all devices
- Do not open files received via social messaging from unverified contacts
- Keep all software updated with automatic updates enabled
- Do not disable SmartScreen warnings on file downloads
Security Awareness
- Train staff on social engineering tactics via social messaging platforms
- Warn targeted individuals about impersonation of trusted contacts and platform support
- Circulate advisory to staff who may be targeted on personal devices
- Instruct users to download software only from official sources or app stores
MITRE ATT&CK Mapping
Reconnaissance
Initial Access
Execution
Persistence
Stealth
Defense Impairment
Discovery
Collection
Command and Control
Exfiltration
Impact
Plain-Language Summary
Iranian government hackers are using a spyware tool called CHOSEN BRICK to spy on dissidents, journalists, and activists in the UK, US, and Netherlands. The hackers contact targets through messaging apps like WhatsApp and Telegram, pretending to be someone the target knows. They trick the target into opening a fake app that secretly installs spyware. The spyware can take screenshots, record audio, steal emails and messages, and even wipe the device. Stolen personal information has been published online to harass victims. Individuals should avoid opening files from unverified contacts.
Additional IOCs
- File Paths:
C:\ProgramData\SMQDServicePackages\...\smdqservice.exe- CHOSEN BRICK payload path in SMQDService persistence entryC:\Users\All Users\MicrosoftDistribution\sysmain\winappx.exe- CHOSEN BRICK payload path in winappx persistence entryC:\Windows \SysWOW64- Non-standard directory with space for additional malware deployment
- domainiproyal[.]comProxy service obscuring Telegram C2 traffic
- domainlightningproxies[.]netProxy service obscuring Telegram C2 traffic
- filenamesmdqservice.exeCHOSEN BRICK payload executable in persistence entry
- filenamewinappx.exeCHOSEN BRICK payload executable in persistence entry
- file_pathC:\ProgramData\SMQDServicePackages\...\smdqservice.exeCHOSEN BRICK payload path in SMQDService persistence entry
- file_pathC:\Users\AllUsers\MicrosoftDistribution\sysmain\winappx.exeCHOSEN BRICK payload path in winappx persistence entry
- file_pathC:\Windows\SysWOW64Non-standard directory with space for additional malware deployment
- mutexnoi672pp434awkc12fCHOSEN BRICK execution guardrail mutex
- mutexytyjyujyuCHOSEN BRICK execution guardrail mutex
- registry_keyHKCU\Software\Microsoft\Windows\CurrentVersion\RunPersistence key abused with SMQDService and winappx values