Chosen Brick: Iranian State-Sponsored Windows Surveillance Malware Exposed by US, UK, and Dutch Agencies

Key facts for CHOSEN BRICK Iranian spyware

Detection coverage for CHOSEN BRICK Iranian spyware

As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2534 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CHOSEN BRICK Disguised Installer Execution via WhatsApp/Telegram Delivery Chain

Detects process execution consistent with CHOSEN BRICK's initial-access chain: a binary launched as a child of Telegram/WhatsApp (or Telegram Desktop), or masquerading as a trusted brand (Norton Antivirus, Adobe Flash Player, KeePass, Pictory, RunwayML) that the joint NCSC/FBI/AIVD advisory documented as disguised-installer lures, or running from an anomalous path containing a deliberate embedded space (e.g. "C:\Windows \SysWOW64") used to evade path-based allowlisting. Matches the social-engineering-to-execution handoff where a rapport-built contact on a messaging app delivers the dropper.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.003, T1204.002, T1656, T1589
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent_lc=lower(ParentImage), img_lc=lower(Image), path_has_space=if(match(Image, "(?i)windows\s+\\syswow64"), 1, 0)
| eval brand_lure=if(match(img_lc, "(?i)norton|flashplayer|adobeflash|keepass|pictory|runwayml"), 1, 0)
| eval messaging_parent=if(like(parent_lc, "%telegram.exe") OR like(parent_lc, "%telegramdesktop%") OR like(parent_lc, "%whatsapp.exe"), 1, 0)
| where messaging_parent=1 OR path_has_space=1 OR brand_lure=1
| where NOT like(img_lc, "c:\\program files%") AND NOT like(img_lc, "c:\\program files (x86)%")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host, User, Image, ParentImage, Hashes
| where count > 0
| sort -last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| extend MessagingParent = InitiatingProcessFileName in~ ("Telegram.exe", "WhatsApp.exe", "Telegram Desktop.exe")
| extend SpacedPath = FolderPath matches regex @"(?i)windows\s+\\syswow64"
| extend BrandLure = FileName has_any ("norton", "flashplayer", "adobeflash", "keepass", "pictory", "runwayml")
| where MessagingParent or SpacedPath or BrandLure
| where FolderPath !startswith @"C:\Program Files"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, MessagingParent, SpacedPath, BrandLure
| order by Timestamp desc

Sigma

title: CHOSEN BRICK Disguised Installer Execution via Messaging-App Parent Process
id: 7c2f4e8a-1b3d-4a6e-9f21-8e5d0c2a7f31
status: experimental
description: Detects execution of a binary spawned by Telegram/WhatsApp, or masquerading as a trusted-brand installer, or running from a path with a deliberate embedded space -- consistent with CHOSEN BRICK's social-engineering delivery chain documented in the 2026-09-15 NCSC/FBI/AIVD joint advisory.
references:
  - https://www.ncsc.gov.uk/news/uk-allies-expose-spyware-iranian-state-actors-target-dissidents-activists-journalists
  - https://www.ic3.gov/CSA/2026/260915.pdf
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-16
tags:
  - attack.initial-access
  - attack.t1566.003
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1656
  - attack.reconnaissance
  - attack.t1589
  - attack.tool.chosen_brick
logsource:
  category: process_creation
  product: windows
detection:
  selection_messaging_parent:
    ParentImage|endswith:
      - '\Telegram.exe'
      - '\WhatsApp.exe'
    ParentImage|contains: 'TelegramDesktop'
  selection_spaced_path:
    Image|re: '(?i)windows\s+\\syswow64'
  selection_brand_lure:
    Image|contains:
      - 'norton'
      - 'flashplayer'
      - 'adobeflash'
      - 'keepass'
      - 'pictory'
      - 'runwayml'
  filter_legit_install_dir:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: (selection_messaging_parent or selection_spaced_path or selection_brand_lure) and not filter_legit_install_dir
falsepositives:
  - Legitimate software updates delivered/opened via Telegram or WhatsApp for business communication
  - Genuine Norton/Adobe/KeePass installers run outside their standard install directory during IT deployment
level: high

Known false positives:

• Legitimate installers or documents shared over Telegram/WhatsApp for business or personal use
• IT staff deploying Norton/Adobe/KeePass installers from a non-standard staging directory

Tuning notes: Baseline normal Telegram/WhatsApp business-use process spawning per host population before enabling as a high-severity alert; extend the brand_lure term list as new impersonated software names surface in future CHOSEN BRICK reporting; the embedded-space path check should be widened to any Windows system directory, not just SysWOW64, since the technique is path-allowlist evasion generally.

• 🔒 CHOSEN BRICK Decoy Document Execution with Deceptive Double Extension or Medical-Lure Filename · unlock with TL Creds
• 🔒 CHOSEN BRICK Reconnaissance Command Sequence from Unsigned Persisted Process · unlock with TL Creds
• 🔒 CHOSEN BRICK Cloud-Object-Storage Exfiltration via Vultr/Storj/Backblaze · unlock with TL Creds
• 🔒 CHOSEN BRICK Impersonated-Contact Rapport-to-Delivery Pattern (Messaging App Attachment Execution) · unlock with TL Creds
• 🔒 CHOSEN BRICK Screen/Audio Capture and Local Data Collection API Usage by Unsigned Persisted Process · unlock with TL Creds
• 🔒 Proxied C2 Beacon Followed by Mass File-Deletion Command (CHOSEN BRICK Destructive Payload) · unlock with TL Creds
• 🔒 CHOSEN BRICK Registry Run-Key Persistence Combined with Defender Exclusion Addition · unlock with TL Creds
• 🔒 CHOSEN BRICK Per-Victim Telegram Bot API C2 Beaconing · unlock with TL Creds

Indicators of compromise for CHOSEN BRICK Iranian spyware

As of 2026-09-16, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-2534.

How CHOSEN BRICK Iranian spyware works

CHOSEN BRICK is a Windows-only surveillance implant that a joint September 15, 2026 advisory from the UK National Cyber Security Centre (NCSC), the US Federal Bureau of Investigation (FBI), and the Netherlands' General Intelligence and Security Service (AIVD) attributed to Iranian state cyber actors. The campaign has targeted dissidents, activists, and journalists perceived as threats to the Iranian regime, with documented victims in the UK, US, and Netherlands since at least 2025 (Recorded Future/The Record additionally references related persona activity dating to fall 2023).

The attack chain begins with extensive social engineering on WhatsApp and Telegram: operators research targets, impersonate trusted contacts or technical-support personnel, and build rapport over multiple interactions before delivering a malicious file. Observed lures include installers disguised as legitimate software (Norton Antivirus, Adobe Flash Player, KeePass, Telegram itself, and the AI tools Pictory and RunwayML) and fabricated documents, most notably a fake MRI scan showing a disc herniation sent to a specific target described as an 'enemy of the regime.' When opened, the dropper displays a decoy screen (e.g., a fake document or installer UI) while silently deploying CHOSEN BRICK in the background.

Once installed, CHOSEN BRICK establishes persistence via a Registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) so it relaunches at every logon, and attempts to add Microsoft Defender exclusions to reduce detection and removal. Its collection capability is broad: screenshot capture, microphone-based audio recording, harvesting of Telegram/WhatsApp chat data and browser-stored data, email content theft, contact and social-media message collection (enabling 'pattern of life' mapping of the target), process enumeration and system reconnaissance, additional payload download, and destructive data-wiping/deletion commands.

Command and control runs over the Telegram Bot API, with each infected endpoint assigned a distinct, per-victim Telegram bot for operational segmentation; more recent samples wrap this traffic in HTTPS or SOCKS5 proxy services (observed proxy providers include iproyal.com and lightningproxies.net) to complicate network-based detection. Exfiltrated data is sent both through the per-victim Telegram bot channel and to commodity cloud object-storage services — Vultr Object Storage (vultrobjects.com), Storj (storjshare.io), and Backblaze B2 (backblazeb2.com) were named as abused exfiltration destinations. Stolen material from some victims has subsequently appeared on pro-Iranian leak sites, with Recorded Future/The Record associating this publication activity with the 'Handala Hack' persona; the same reporting (single-sourced relative to the joint government advisory) attributes the operation to Iran's Ministry of Intelligence and Security (MOIS) and notes possible links to the 'Homeland Justice' persona, and cites an FBI tracking alias of HEAVYGRAM for the malware family.

No CVE or exploited vulnerability is associated with this campaign — initial access is entirely social-engineering-driven rather than exploit-based, and no public IOC file hashes were available in open reporting at publication time; the joint advisory instead recommends monitoring DNS and web-proxy logs for unexpected connections to the abused Telegram/cloud-storage infrastructure.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1114.001 Email Collection: Local Email Collection; T1123 Audio Capture

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Command and Control

T1090.002 Proxy: External Proxy; T1102.002 Web Service: Bidirectional Communication

Execution

T1204.002 User Execution: Malicious File

Impact

T1485 Data Destruction

Persistence

T1547.001 Registry Run Keys / Startup Folder

Initial Access

T1566.003 Phishing: Spearphishing via Service

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Reconnaissance

T1589 Gather Victim Identity Information

Defense Evasion

T1684.001 Impersonation

defense-impairment

T1685 Disable or Modify Tools

Remediation for CHOSEN BRICK Iranian spyware

Immediate actions

• Monitor DNS and web-proxy logs for connections to api.telegram.org, vultrobjects.com, storjshare.io, and backblazeb2.com that are not expected as part of normal business use, per NCSC guidance
• Audit Microsoft Defender exclusion lists for unauthorized additions
• Audit HKCU\Software\Microsoft\Windows\CurrentVersion\Run for unrecognized entries

Workarounds

• Verify installer authenticity and publisher signature before running software received via messaging apps, even from apparent known contacts
• Treat unsolicited medical or personal documents received over messaging apps as high-risk attachments

Longer-term hardening

• Security-awareness training on messaging-app (WhatsApp/Telegram) impersonation and rapport-building social engineering, particularly for high-risk individuals (journalists, activists, dissidents)
• Deploy EDR with behavioral detection for screen/microphone capture APIs and unsigned installer execution
• Application allowlisting to block unsigned or unexpected installer execution from user-writable paths

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: all supported consumer/desktop Windows versions (delivered via social engineering, not exploit)

Timeline of CHOSEN BRICK Iranian spyware

• 2023-09-01 Recorded Future/The Record reports related Iranian surveillance-campaign persona activity dating to approximately fall 2023 (predates confirmed locked-ioc-12 attribution; approximate date, exact date not specified in source).
• 2025-01-01 Joint advisory and press reporting describe locked-ioc-12 as active against victims in the UK, US, and Netherlands 'at least since 2025'; exact first-observed date not disclosed in public sources.
• 2026-09-15 GBHackers, CyberPress, The Record, Jerusalem Post, and gblock.app publish technical write-ups summarizing the joint advisory's findings on delivery lures, persistence, and C2/exfiltration infrastructure.
• 2026-09-15 FBI publishes IC3 Cybersecurity Advisory CSA-2026-260915 documenting locked-ioc-12 alongside the joint NCSC/AIVD release.
• 2026-09-15 UK NCSC, US FBI, and Netherlands AIVD jointly publish an advisory exposing locked-ioc-12 and attributing it to Iranian state cyber actors.
• 2026-09-16 SecurityWeek publishes coverage of the joint advisory, the source article that triggered this threat record.

Sources cited for CHOSEN BRICK Iranian spyware

• UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists NCSC (UK) · Advisory · 2026-09-15
• Iranian cyber targeting of dissidents, activists and journalists NCSC (UK) · Advisory · 2026-09-15
• UK and allies expose spyware used by Iranian state actors (joint advisory PDF) NCSC (UK) · Advisory · 2026-09-15
• FBI IC3 Cybersecurity Advisory CSA-2026-260915 (CHOSEN BRICK) ic3.gov · Advisory · 2026-09-15
• US, UK, Dutch Agencies Expose Iranian 'Chosen Brick' Surveillance Malware SecurityWeek · News · 2026-09-16
• Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results gbhackers.com · News · 2026-09-15
• CHOSEN BRICK Malware Lets Iranian State Hackers Steal Emails, WhatsApp and Telegram Data cyberpress.org · News · 2026-09-15
• Iranian cyber spies used fake MRI scan results to hack 'enemy of regime' The Record · News · 2026-09-15
• US, UK, Netherlands warn of Iranian CHOSEN BRICK spyware targeting press jpost.com · News · 2026-09-15
• Iran's CHOSEN BRICK Spyware Reads Journalists' Email gblock.app · News · 2026-09-15

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

Previous and next in malware

• PeckBirdy JScript C2 Framework Hides China-Aligned APT Infrastructure Inside a Casino-Site Network (CVE-2020-16040) Previous report
• Iranian State Actors Deploy CHOSEN BRICK Windows Malware to Spy on Dissidents, Activists, and Journalists Next report