Iran's Chosen Brick Malware Targets Journalists and Dissidents…

A joint advisory from the FBI, UK NCSC, and Dutch AIVD exposes Chosen Brick, a sophisticated malware that surveils dissidents, activists, and journalists through social engineering on WhatsApp and Telegram.

{"main_topic":"malware","topics":["cybersecurity","malware","phishing"]}

Key Takeaways

Iranian state cyber actors distribute Chosen Brick, also designated HEAVYGRAM by the FBI, exclusively on Windows systems from at least 2025.
Infection begins via messages on WhatsApp and Telegram from seemingly trusted contacts, with files disguised as legitimate applications such as Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass.
The malware establishes persistence via the Run registry key, evades Microsoft Defender by adding exclusions, and communicates through unique per-victim Telegram bots to exfiltrate data and receive commands.
Attribution falls to Iran's Ministry of Intelligence and Security (MOIS); stolen data has resurfaced on pro-Iranian leak sites.

How the Attack Works: From Message to Persistence

The joint advisory issued on September 15, 2026 by the FBI, UK NCSC, and Dutch AIVD precisely maps the infection chain. Attackers conduct extensive reconnaissance on victims before initial contact, building detailed profiles that make subsequent messages credible. Communications arrive on WhatsApp and Telegram—platforms considered safe for daily use—from numbers impersonating trusted contacts or known organizations.

The malicious files do not present as suspicious executables. According to The Register, the impersonated applications include Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass. Techlicious adds a disturbing detail: in some cases, attackers sent fake MRI results, betting the target would open a document seemingly related to their own health.

Once executed, the malware installs silently and survives system reboots. Persistence is guaranteed via the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, a classic but effective mechanism that does not require elevated administrative privileges. To evade detection, Chosen Brick adds exclusions to Microsoft Defender, reducing visibility of its activities on the compromised machine.

What It Steals and How It Communicates: The Spyware Architecture

The malware is designed for systematic collection of personal and professional information. According to the advisory cited by The Register, Chosen Brick steals contacts, emails, social media messages, captures screenshots and microphone audio, enumerates running processes, and gathers detailed system information. This combination of capabilities turns the compromised device into a total surveillance platform, capable of documenting not only what the victim writes, but also what they say and who they interact with digitally.

Communication with command-and-control servers does not pass through traditional infrastructure easily traced or blocked. The malware connects to Telegram using bots specific to each individual victim. This architecture gives operators flexibility: they can exfiltrate data and send remote commands through a legitimate platform whose traffic raises no suspicion on home or corporate networks. The malware can also download additional payloads, extending its capabilities without requiring new victim interaction.

A relevant element for risk assessment: automated lateral movement has not been observed in documented campaigns, but the advisory flags it as technically possible. This limitation in the dossier suggests operators prioritize targeted collection on individual devices rather than lateral expansion within complex networks, consistent with an objective of individual surveillance rather than large-scale destruction or extortion.

"Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists" — Joint FBI/NCSC/AIVD Advisory

Attribution and Data Destination: The Repression Circuit

Attribution to Iran is not generic. According to Techlicious, which cites the FBI document directly, the campaign is traced to Iran's Ministry of Intelligence and Security (MOIS). This specific designation goes beyond the usual reference to "state-sponsored actors" to identify a concrete government organization—the one that coordinates internal and external intelligence activities in Iran.

The data path does not end at exfiltration. Techlicious reports that personal information stolen from previous Chosen Brick victims has resurfaced on pro-Iranian leak sites. This detail is significant: it transforms the malware from a collection tool into a link in a public repression chain, where digital compromise feeds intimidation and media exposure of dissidents.

A quote from Paul Chichester, NCSC Director of Operations, summarizes the picture: "The details of this cyber campaign reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices." The word choice—"ruthlessly"—is not journalistic rhetoric but reflects the assessment of the agencies involved.

What to Do Now

Verify personal devices of at-risk employees: journalists, activists, researchers, and collaborators with public exposure must treat their Windows laptops and smartphones as extensions of the corporate perimeter, not as private spheres excluded from controls.
Inspect Microsoft Defender exclusions: Chosen Brick's technique for evading detection passes through modification of antivirus exclusions. A periodic review of policies and exclusion lists can reveal active compromises.
Exercise caution when opening files: executables disguised as legitimate applications represent the primary vector. The advisory highlights that attackers invest in preliminary victim research, making the social engineering highly personalized and therefore more dangerous.
Monitor unjustified traffic to Telegram: the use of unique per-victim Telegram bots as a C2 channel is a distinctive pattern. Connection anomalies toward Telegram APIs or domains from systems that should not use the app can signal active infections.

The Forgotten Perimeter: When the Home Phone Becomes the Gap

The three-agency advisory represents a documented escalation in state-sponsored digital surveillance. The novelty lies not in technical sophistication: Chosen Brick employs known persistence techniques and C2 channels that exploit consumer services. The novelty lies in the target and the method. Journalists, dissidents, and activists are no longer theoretical targets of economic or military intelligence, but operational targets of malware distributed through the same platforms they use to communicate with family and colleagues.

This campaign exposes a widespread false sense of security: the separation between corporate and personal devices, between protected networks and home connections, between professional profiles and private identities. When the attacker studies the victim for weeks and sends a file that looks like a personal medical result, the traditional technological perimeter becomes irrelevant. Defense does not require more expensive firewalls but a redesign of the very concept of risk: anyone publicly visible—by opinion, profession, or political choice—carries a personal device that can become the entry point to their professional network and that of their contacts.

The dossier does not specify the exact number of confirmed victims nor the precise geography beyond a "worldwide" scope. It also does not document the existence of indicators of compromise published in the original advisory, nor verified technical connections between Chosen Brick and previous campaigns attributed to Iran. These gaps leave open questions about the campaign's true extent and the possibility that undocumented variants are active with different delivery techniques.

Information has been verified against cited sources and updated at time of publication.

Sources

Sources and references

Get DeafLetter