# Chosen Brick: Iranian State-Sponsored Windows Surveillance Malware Exposed by US, UK, and Dutch Agencies

> UK NCSC, US FBI, and the Netherlands' AIVD jointly exposed CHOSEN BRICK, Windows-only surveillance malware used by Iranian state cyber actors against dissidents, activists, and journalists. Delivered via WhatsApp/Telegram social engineering with disguised installers and decoy documents (including a fake MRI scan), it captures screenshots and microphone audio, steals browser chat data and email, and exfiltrates via a per-victim Telegram bot and abused cloud storage services.

- **Published:** 2026-09-16T00:00:00Z
- **Last reviewed:** 2026-09-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2534
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-chosen-brick-iranian-spyware-tl-2026-2534.webp?v=758a6410 (Threadlinqs threat intel: CHOSEN BRICK Iranian spyware: Detection & IOCs (TL-2026-2534) — High severity, 18 IOCs, 9 detection rules.)
- **ID:** TL-2026-2534
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Iranian state cyber actors (Iran)
- **Detections:** 9 (1 shown free below) · **IOCs:** 18

## Description

CHOSEN BRICK is a Windows-only surveillance implant that a joint September 15, 2026 advisory from the UK National Cyber Security Centre (NCSC), the US Federal Bureau of Investigation (FBI), and the Netherlands' General Intelligence and Security Service (AIVD) attributed to Iranian state cyber actors. The campaign has targeted dissidents, activists, and journalists perceived as threats to the Iranian regime, with documented victims in the UK, US, and Netherlands since at least 2025 (Recorded Future/The Record additionally references related persona activity dating to fall 2023).

The attack chain begins with extensive social engineering on WhatsApp and Telegram: operators research targets, impersonate trusted contacts or technical-support personnel, and build rapport over multiple interactions before delivering a malicious file. Observed lures include installers disguised as legitimate software (Norton Antivirus, Adobe Flash Player, KeePass, Telegram itself, and the AI tools Pictory and RunwayML) and fabricated documents, most notably a fake MRI scan showing a disc herniation sent to a specific target described as an 'enemy of the regime.' When opened, the dropper displays a decoy screen (e.g., a fake document or installer UI) while silently deploying CHOSEN BRICK in the background.

Once installed, CHOSEN BRICK establishes persistence via a Registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) so it relaunches at every logon, and attempts to add Microsoft Defender exclusions to reduce detection and removal. Its collection capability is broad: screenshot capture, microphone-based audio recording, harvesting of Telegram/WhatsApp chat data and browser-stored data, email content theft, contact and social-media message collection (enabling 'pattern of life' mapping of the target), process enumeration and system reconnaissance, additional payload download, and destructive data-wiping/deletion commands.

Command and control runs over the Telegram Bot API, with each infected endpoint assigned a distinct, per-victim Telegram bot for operational segmentation; more recent samples wrap this traffic in HTTPS or SOCKS5 proxy services (observed proxy providers include iproyal.com and lightningproxies.net) to complicate network-based detection. Exfiltrated data is sent both through the per-victim Telegram bot channel and to commodity cloud object-storage services — Vultr Object Storage (vultrobjects.com), Storj (storjshare.io), and Backblaze B2 (backblazeb2.com) were named as abused exfiltration destinations. Stolen material from some victims has subsequently appeared on pro-Iranian leak sites, with Recorded Future/The Record associating this publication activity with the 'Handala Hack' persona; the same reporting (single-sourced relative to the joint government advisory) attributes the operation to Iran's Ministry of Intelligence and Security (MOIS) and notes possible links to the 'Homeland Justice' persona, and cites an FBI tracking alias of HEAVYGRAM for the malware family.

No CVE or exploited vulnerability is associated with this campaign — initial access is entirely social-engineering-driven rather than exploit-based, and no public IOC file hashes were available in open reporting at publication time; the joint advisory instead recommends monitoring DNS and web-proxy logs for unexpected connections to the abused Telegram/cloud-storage infrastructure.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1566.003 Phishing: Spearphishing via Service
- T1204.002 User Execution: Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1685 Disable or Modify Tools
- T1684.001 Impersonation
- T1057 Process Discovery
- T1082 System Information Discovery
- T1113 Screen Capture
- T1123 Audio Capture
- T1114.001 Email Collection: Local Email Collection
- T1005 Data from Local System
- T1102.002 Web Service: Bidirectional Communication
- T1090.002 Proxy: External Proxy
- T1567.002 Exfiltration to Cloud Storage
- T1485 Data Destruction

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CHOSEN BRICK Disguised Installer Execution via WhatsApp/Telegram Delivery Chain** (`TL-2026-2534-SPL-001`)

Detects process execution consistent with CHOSEN BRICK's initial-access chain: a binary launched as a child of Telegram/WhatsApp (or Telegram Desktop), or masquerading as a trusted brand (Norton Antivirus, Adobe Flash Player, KeePass, Pictory, RunwayML) that the joint NCSC/FBI/AIVD advisory documented as disguised-installer lures, or running from an anomalous path containing a deliberate embedded space (e.g. "C:\Windows \SysWOW64") used to evade path-based allowlisting. Matches the social-engineering-to-execution handoff where a rapport-built contact on a messaging app delivers the dropper.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.003, T1204.002, T1656, T1589
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent_lc=lower(ParentImage), img_lc=lower(Image), path_has_space=if(match(Image, "(?i)windows\s+\\syswow64"), 1, 0)
| eval brand_lure=if(match(img_lc, "(?i)norton|flashplayer|adobeflash|keepass|pictory|runwayml"), 1, 0)
| eval messaging_parent=if(like(parent_lc, "%telegram.exe") OR like(parent_lc, "%telegramdesktop%") OR like(parent_lc, "%whatsapp.exe"), 1, 0)
| where messaging_parent=1 OR path_has_space=1 OR brand_lure=1
| where NOT like(img_lc, "c:\\program files%") AND NOT like(img_lc, "c:\\program files (x86)%")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host, User, Image, ParentImage, Hashes
| where count > 0
| sort -last_seen
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| extend MessagingParent = InitiatingProcessFileName in~ ("Telegram.exe", "WhatsApp.exe", "Telegram Desktop.exe")
| extend SpacedPath = FolderPath matches regex @"(?i)windows\s+\\syswow64"
| extend BrandLure = FileName has_any ("norton", "flashplayer", "adobeflash", "keepass", "pictory", "runwayml")
| where MessagingParent or SpacedPath or BrandLure
| where FolderPath !startswith @"C:\Program Files"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, MessagingParent, SpacedPath, BrandLure
| order by Timestamp desc
```

### Sigma

```yaml
title: CHOSEN BRICK Disguised Installer Execution via Messaging-App Parent Process
id: 7c2f4e8a-1b3d-4a6e-9f21-8e5d0c2a7f31
status: experimental
description: Detects execution of a binary spawned by Telegram/WhatsApp, or masquerading as a trusted-brand installer, or running from a path with a deliberate embedded space -- consistent with CHOSEN BRICK's social-engineering delivery chain documented in the 2026-09-15 NCSC/FBI/AIVD joint advisory.
references:
  - https://www.ncsc.gov.uk/news/uk-allies-expose-spyware-iranian-state-actors-target-dissidents-activists-journalists
  - https://www.ic3.gov/CSA/2026/260915.pdf
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-16
tags:
  - attack.initial-access
  - attack.t1566.003
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1656
  - attack.reconnaissance
  - attack.t1589
  - attack.tool.chosen_brick
logsource:
  category: process_creation
  product: windows
detection:
  selection_messaging_parent:
    ParentImage|endswith:
      - '\Telegram.exe'
      - '\WhatsApp.exe'
    ParentImage|contains: 'TelegramDesktop'
  selection_spaced_path:
    Image|re: '(?i)windows\s+\\syswow64'
  selection_brand_lure:
    Image|contains:
      - 'norton'
      - 'flashplayer'
      - 'adobeflash'
      - 'keepass'
      - 'pictory'
      - 'runwayml'
  filter_legit_install_dir:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: (selection_messaging_parent or selection_spaced_path or selection_brand_lure) and not filter_legit_install_dir
falsepositives:
  - Legitimate software updates delivered/opened via Telegram or WhatsApp for business communication
  - Genuine Norton/Adobe/KeePass installers run outside their standard install directory during IT deployment
level: high
```

**Known false positives:**

- Legitimate installers or documents shared over Telegram/WhatsApp for business or personal use
- IT staff deploying Norton/Adobe/KeePass installers from a non-standard staging directory

**Tuning notes:** Baseline normal Telegram/WhatsApp business-use process spawning per host population before enabling as a high-severity alert; extend the brand_lure term list as new impersonated software names surface in future CHOSEN BRICK reporting; the embedded-space path check should be widened to any Windows system directory, not just SysWOW64, since the technique is path-allowlist evasion generally.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CHOSEN BRICK Decoy Document Execution with Deceptive Double Extension or Medical-Lure Filename (locked: unlock with TL Creds)
- CHOSEN BRICK Reconnaissance Command Sequence from Unsigned Persisted Process (locked: unlock with TL Creds)
- CHOSEN BRICK Cloud-Object-Storage Exfiltration via Vultr/Storj/Backblaze (locked: unlock with TL Creds)
- CHOSEN BRICK Impersonated-Contact Rapport-to-Delivery Pattern (Messaging App Attachment Execution) (locked: unlock with TL Creds)
- CHOSEN BRICK Screen/Audio Capture and Local Data Collection API Usage by Unsigned Persisted Process (locked: unlock with TL Creds)
- Proxied C2 Beacon Followed by Mass File-Deletion Command (CHOSEN BRICK Destructive Payload) (locked: unlock with TL Creds)
- CHOSEN BRICK Registry Run-Key Persistence Combined with Defender Exclusion Addition (locked: unlock with TL Creds)
- CHOSEN BRICK Per-Victim Telegram Bot API C2 Beaconing (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [US, UK, Dutch Agencies Expose Iranian 'Chosen Brick' Surveillance Malware](https://www.securityweek.com/us-uk-dutch-agencies-expose-iranian-chosen-brick-surveillance-malware/)
- [UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists](https://www.ncsc.gov.uk/news/uk-allies-expose-spyware-iranian-state-actors-target-dissidents-activists-journalists)
- [Iranian cyber targeting of dissidents, activists and journalists](https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists)
- [UK and allies expose spyware used by Iranian state actors (joint advisory PDF)](https://www.ncsc.gov.uk/sites/default/files/2026-09/UK-and-allies-expose-spyware-used-by-Iranian-state-actors-to-target-dissidents-activists-and-journalists.pdf)
- [FBI IC3 Cybersecurity Advisory CSA-2026-260915 (CHOSEN BRICK)](https://www.ic3.gov/CSA/2026/260915.pdf)
- [Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results](https://gbhackers.com/chosen-brick-malware/)
- [CHOSEN BRICK Malware Lets Iranian State Hackers Steal Emails, WhatsApp and Telegram Data](https://cyberpress.org/chosen-brick-steals-messaging-data/)
- [Iranian cyber spies used fake MRI scan results to hack 'enemy of regime'](https://therecord.media/iran-cyber-spies-use-fake-mri-scans-as-lure)
- [US, UK, Netherlands warn of Iranian CHOSEN BRICK spyware targeting press](http://www.jpost.com/middle-east/iran-news/article-908693)
- [Iran's CHOSEN BRICK Spyware Reads Journalists' Email](https://www.gblock.app/articles/iran-chosen-brick-spyware-journalists-advisory-2026)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2534