UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists
Iranian state actors deploy CHOSEN BRICK spyware via messaging app social engineering to surveil dissidents, activists, and journalists on Windows devices. CHOSEN BRICK persists on Windows and captures screen content, microphone audio, contacts, emails, and social media messages. Operators impersonate contacts on WhatsApp and Telegram to deliver the spyware. Stolen data has appeared on pro-Iranian leak sites.
Detection / Hunteropenrouter
Immediate Actions
- Review FBI technical report at ic3.gov for IOCs and detection guidance
- Sign up at-risk individuals for NCSC free cyber defence services
- Block known CHOSEN BRICK indicators from the joint advisory
Key Takeaways
- Malware is persistent on Windows and survives device reboot
- Operators impersonate contacts on WhatsApp and Telegram to build rapport
- Fake MRI test results used as lures in social engineering
- Stolen personal data appeared on pro-Iranian leak sites
- Joint advisory issued by NCSC, FBI, and Dutch AIVD
Attack Chain
- Reconnaissance: Actors research targets' interests and contacts for tailored social engineering
- Initial Access: Operators impersonate contacts on WhatsApp and Telegram to build rapport
- Execution: Targets tricked into downloading CHOSEN BRICK spyware
- Persistence: Malware establishes persistence surviving device reboot on Windows
- Collection: Spyware captures screen content, microphone audio, contacts, emails, and messages
- Exfiltration: Stolen data published on pro-Iranian leak sites
Affected Systems
- Windows operating systems
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Screen capture, microphone access, and persistence on Windows are EDR-observable behaviors. |
| Network Visibility | Low | Article does not describe C2 protocols or network indicators for CHOSEN BRICK. |
| Detection Difficulty | Hard | Social engineering via legitimate messaging apps and tailored lures bypass traditional email security. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Unusual processes invoking screen capture APIs or accessing microphone hardware (T1113, T1123) | EDR process and API access logs | Collection | Medium — legitimate apps use these APIs |
| New persistence mechanisms created shortly after messaging app interactions (T1547) | Registry and startup folder modification logs | Persistence | Low — new startup entries from downloads are rare |
| Software downloaded after messaging app conversations establishing registry run keys (T1566.002, T1547) | Process execution with parent-child relationships | Execution | Medium — some legitimate apps self-install |
Required Log Sources
- EDR process telemetry
- Windows startup registry events
- File system creation events
- Microphone access logs
- Screen capture API calls
Key Behavioral Indicators
- Unusual processes accessing screen capture APIs on Windows
- Microphone access by non-standard or newly created applications
- New startup registry entries from downloaded executables
- Process ancestry showing browser or messaging app spawning installer
Control Gaps
- Social engineering via legitimate messaging platforms bypasses email security
- Tailored lures like fake MRI results evade content filtering
- No network indicators published in this article
False Positive Assessment
Low — spyware behaviors like screen capture and microphone access from unknown software are distinctive for targeted individuals.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Deploy EDR on Windows devices of at-risk individuals
- Monitor for screen capture and microphone access by unusual processes
- Alert on new persistence mechanisms created from downloaded files
User Protection
- Verify identity of contacts on messaging apps before downloading files
- Enable MFA on all accounts and use end-to-end encrypted messaging
- Avoid downloading software from links received via WhatsApp or Telegram
Security Awareness
- Train at-risk individuals on Iranian state actor social engineering tactics
- Warn about fake MRI test results and tailored lures in messaging apps
MITRE ATT&CK Mapping
Initial Access
Execution
Persistence
Collection
Exfiltration
Plain-Language Summary
Iranian government hackers are using fake messages on apps like WhatsApp and Telegram to trick journalists, activists, and government critics into installing spyware called CHOSEN BRICK. The spyware secretly records the screen, listens through the microphone, and steals contacts and messages, then stays on the device even after a restart. People at risk should review the government advisory, use free cyber defence services, and be cautious about downloading files from messaging apps.