Iranian State Actors Deploy CHOSEN BRICK Windows Malware to Spy on Dissidents, Activists, and Journalists

Key facts for CHOSEN BRICK activist malware

Detection coverage for CHOSEN BRICK activist malware

As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2543 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CHOSEN BRICK HKCU Run-Key Persistence Followed by Process/System Discovery

Detects creation of the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry values SMQDService or winappx (user-level autostart persistence) followed within a short window by tasklist/systeminfo-style process and system enumeration in the same host/user session -- the discovery activity CHOSEN BRICK performs immediately after establishing persistence to profile the compromised machine.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1547.001, T1057, T1082
• Data sources: sysmon, microsoft_defender_for_endpoint, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
| where TargetObject="*CurrentVersion\\Run\\SMQDService" OR TargetObject="*CurrentVersion\\Run\\winappx"
| rename Details as PersistTarget
| eval persist_time=_time
| join type=left host user
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\tasklist.exe" OR Image="*\\systeminfo.exe" OR CommandLine="*Win32_Process*" OR CommandLine="*Get-Process*" OR CommandLine="*Get-ComputerInfo*")
      | stats count as discovery_count earliest(_time) as discovery_time by host user ]
| table _time host user TargetObject PersistTarget discovery_count discovery_time
| sort -_time

Microsoft KQL

DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentVersion\Run" and RegistryValueName in~ ("SMQDService","winappx")
| project PersistTime=Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, RegistryValueName, RegistryValueData
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("tasklist.exe","systeminfo.exe","whoami.exe") or ProcessCommandLine has_any ("Win32_Process","Get-ComputerInfo","Get-Process")
    | project DiscTime=Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
) on DeviceName, AccountName
| where isempty(DiscTime) or DiscTime between (PersistTime .. PersistTime + 30m)
| project PersistTime, DiscTime, DeviceName, AccountName, RegistryValueName, RegistryValueData, FileName, ProcessCommandLine
| order by PersistTime desc

Sigma

title: CHOSEN BRICK Run-Key Persistence (SMQDService / winappx) with Post-Persistence Host Discovery
id: 7c1e4b2a-9a3d-4f5e-8b6c-1a2d3e4f5064
status: experimental
description: Detects creation of the reported CHOSEN BRICK Run-key values, optionally followed by host/process discovery commands.
references:
    - https://www.ic3.gov/CSA/2026/260915-2.pdf
author: AII-Detector -- ThreadLinqs Intelligence
date: 2026/09/16
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.discovery
    - attack.t1057
    - attack.t1082
    - attack.tool.chosen_brick
logsource:
    category: registry_set
    product: windows
detection:
    selection_persist:
        TargetObject|contains: 'CurrentVersion\Run\'
        TargetObject|endswith:
            - 'SMQDService'
            - 'winappx'
    condition: selection_persist
falsepositives:
    - Legitimate software coincidentally using the value name 'winappx' or 'SMQDService' (verify the target executable's path/hash against known-good vendors)
level: high

Known false positives:

• Legitimate application coincidentally using the generic value name 'winappx' or 'SMQDService' (rare; verify target executable path/hash)
• IT-run inventory/asset-discovery scripts (tasklist/systeminfo) scheduled around the same time -- correlate with known scan schedules before escalating

Tuning notes: The registry value names are hardcoded IOCs from a single observed campaign window; broaden by also alerting on any new HKCU Run value whose target path resolves to ProgramData or a 'MicrosoftDistribution'-style masquerading vendor folder, not just the exact value names, to catch renamed variants.

• 🔒 CHOSEN BRICK Dropped Payload Execution from Known Drop Paths / Space-Masqueraded Windows Directory · unlock with TL Creds
• 🔒 CHOSEN BRICK Screen-Capture and Microphone-Audio Surveillance Collection · unlock with TL Creds
• 🔒 Endpoint Egress to Commercial SOCKS5/HTTPS Proxy Services Preceding Telegram/Cloud-Storage Traffic · unlock with TL Creds
• 🔒 CHOSEN BRICK Install-Time Defense Evasion -- Execution-Guardrail Mutex and Defender Exclusion Addition · unlock with TL Creds
• 🔒 CHOSEN BRICK Local Email and WhatsApp/Telegram Chat-Data Harvesting · unlock with TL Creds
• 🔒 CHOSEN BRICK Cloud-Object-Storage Exfiltration Followed by Mass File Deletion (Data-Wipe Indicator) · unlock with TL Creds
• 🔒 CHOSEN BRICK Lure-Branded Installer Execution via WhatsApp/Telegram Delivery · unlock with TL Creds
• 🔒 CHOSEN BRICK Per-Victim Telegram Bot API C2 Beaconing · unlock with TL Creds

Indicators of compromise for CHOSEN BRICK activist malware

As of 2026-09-16, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2543.

Sample indicators (3 of 19)

• Domain: backblazeb2[.]com
• Domain: vultrobjects[.]com
• Domain: storjshare[.]io

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

How CHOSEN BRICK activist malware works

Victims are lured via WhatsApp/Telegram social engineering into installing trojanized apps, after which the malware harvests communications, screenshots, and audio over a per-victim Telegram-bot C2 channel and can fully wipe the infected device.

CHOSEN BRICK (tracked separately by the FBI as HEAVYGRAM, the same malware lineage first linked to activity dating to autumn 2023) is a Windows-only surveillance and data-theft implant deployed by Iranian state cyber actors operating for Iran's Ministry of Intelligence and Security (MOIS). A joint advisory published 15 September 2026 by the UK National Cyber Security Centre (NCSC), the US Federal Bureau of Investigation (via IC3, CSA 260915-2), and the Netherlands' General Intelligence and Security Service (AIVD) attributes an active campaign, documented since at least 2025, targeting dissidents, activists, and journalists in the US, UK, and Netherlands who are perceived as threats to the Iranian regime.

Operators build rapport with targets over WhatsApp and Telegram, impersonating trusted acquaintances or platform/IT technical-support representatives, before delivering a malicious file disguised as a legitimate application (Pictory, RunwayML, Norton Antivirus, Telegram itself, Adobe Flash Player, KeePass) or a fabricated document such as an MRI scan result. Corporate targets whose devices are protected by enterprise security controls are frequently redirected toward less-defended personal devices. Once executed, CHOSEN BRICK/HEAVYGRAM establishes persistence via the HKCU Run registry key (observed values SMQDService and winappx), guards against re-infection using hardcoded mutexes (ytyjyujyu, noi672pp434awkc12f), and adds Microsoft Defender exclusions to reduce the likelihood its files are scanned or removed.

The implant collects screenshots, microphone audio, running-process and system information, email content, and WhatsApp/Telegram browser chat data, and can download additional payloads. Command and control is conducted through per-victim Telegram bots (a unique bot ID per infected machine, preventing cross-victim contamination), with newer variants relaying that Telegram traffic through commercial HTTPS/SOCKS5 proxy services (IPRoyal, LightningProxies) to obscure the C2 channel; stolen data is also exfiltrated to legitimate cloud object-storage services (Backblaze B2, Vultr Object Storage, Storj). At least one observed variant carries a full data-wipe capability, giving operators a destructive option against journalists' and activists' devices in addition to ongoing surveillance.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1114.001 Local Email Collection; T1123 Audio Capture

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Command and Control

T1090.002 External Proxy; T1102.002 Bidirectional Communication

Execution

T1204.002 Malicious File

Defense Evasion

T1480.002 Mutual Exclusion

Impact

T1485 Data Destruction

Persistence

T1547.001 Registry Run Keys / Startup Folder

Initial Access

T1566.003 Spearphishing via Service

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Resource Development

T1585.001 Social Media Accounts

Reconnaissance

T1589 Gather Victim Identity Information

defense-impairment

T1685 Disable or Modify Tools

Remediation for CHOSEN BRICK activist malware

Immediate actions

• Search endpoint logs and the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key for the reported values SMQDService and winappx
• Search for the reported mutexes ytyjyujyu and noi672pp434awkc12f as execution-guardrail indicators of infection
• Review Microsoft Defender exclusion lists for unexpected entries, particularly paths resembling C:\Windows \SysWOW64 (note the inserted space)
• Monitor or restrict egress to backblazeb2.com, vultrobjects.com, storjshare.io, iproyal.com, and lightningproxies.net where not business-required
• Report suspected compromises to national authorities: UK report.ncsc.gov.uk, US FBI IC3 (ic3.gov), Netherlands AIVD

Workarounds

• Do not install software received via links or attachments sent over WhatsApp or Telegram; install only from official app stores or vendor sites
• Do not disable SmartScreen or antivirus warnings when prompted during software installation
• Keep operating systems and applications configured for automatic updates

Longer-term hardening

• Deploy phishing-resistant MFA for at-risk individuals such as journalists, activists, and dissidents
• Enable application allowlisting and endpoint monitoring to flag unauthorized Registry Run-key modifications and new Defender exclusions
• Provide social-engineering awareness training focused on WhatsApp/Telegram impersonation of trusted contacts and IT support staff
• Segment and separately monitor personal devices used by high-risk individuals who also hold corporate access

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: All supported Windows versions (malware is delivered via social engineering, not a software vulnerability)

Timeline of CHOSEN BRICK activist malware

• 2023-09-01 FBI begins tracking a malware family later publicly named locked-ioc-15 (NCSC designation: locked-ioc-13), with the earliest linked activity dating to autumn 2023.
• 2025-01-01 Iranian state actors observed deploying locked-ioc-13/locked-ioc-15 against dissidents, activists, and journalists in the US, UK, and Netherlands, per the joint advisory's documented 'at least 2025' activity window.
• 2026-09-15 Advisory discloses that newer locked-ioc-13/locked-ioc-15 variants route locked-ioc-17 C2 traffic through commercial HTTPS/SOCKS5 proxy services (IPRoyal, LightningProxies) to obscure communications.
• 2026-09-15 Advisory documents the full attack chain: WhatsApp/locked-ioc-17 rapport-building, delivery of trojanized apps or fraudulent MRI documents, HKCU registry Run-key persistence, Microsoft Defender exclusion abuse, per-victim Telegram-bot C2, and screenshot/audio/email/browser-chat collection culminating in optional additional-payload download or full data wipe.
• 2026-09-15 UK NCSC, US FBI (via IC3 CSA 260915-2), and Netherlands AIVD jointly publish an advisory attributing locked-ioc-13/locked-ioc-15 to Iran's Ministry of Intelligence and Security (MOIS), detailing TTPs, IOCs, and mitigations.
• 2026-09-16 BleepingComputer, SecurityWeek, The Hacker News, Infosecurity Magazine, and other outlets report on the joint advisory, amplifying public awareness of the campaign.
• 2026-09-16 FBI publicly attributes locked-ioc-15 operations to Iran's MOIS, stating the tool is used to collect intelligence, conduct data leaks, and inflict reputational harm against regime-perceived opponents.

Sources cited for CHOSEN BRICK activist malware

• Iranian cyber targeting of dissidents, activists and journalists NCSC (UK) · Advisory · 2026-09-15
• UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists NCSC (UK) · Advisory · 2026-09-15
• Joint Cybersecurity Advisory: Iranian State Actor Use of CHOSEN BRICK / HEAVYGRAM Malware (IC3 CSA 260915-2) ic3.gov · Advisory · 2026-09-15
• Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results gbhackers.com · Blog · 2026-09-16
• CHOSEN BRICK Malware Lets Iranian State Hackers Steal Emails, WhatsApp and Telegram Data cyberpress.org · Blog · 2026-09-16
• Iranian hackers use CHOSEN BRICK Windows malware to spy on targets BleepingComputer · News · 2026-09-16
• US, UK, Dutch Agencies Expose Iranian 'Chosen Brick' Surveillance Malware SecurityWeek · News · 2026-09-16
• Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists The Hacker News · News · 2026-09-16
• NCSC and Allies Warn of Iranian Spyware Campaign infosecurity-magazine.com · News · 2026-09-16
• FBI Details Iranian HEAVYGRAM Malware Campaign Targeting Dissidents and Journalists hstoday.us · News · 2026-09-16

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

More from Iran Ministry of Intelligence

• Iranian MOIS-Linked Actor Uses Telegram-Controlled HEAVYGRAM/CHOSEN BRICK Malware Against Dissidents and Journalists

Previous and next in malware

• Chosen Brick: Iranian State-Sponsored Windows Surveillance Malware Exposed by US, UK, and Dutch Agencies Previous report
• KREMLIN Banking Malware Forges Chrome/Edge Secure Preferences Integrity Checks to Force-Install Malicious 'AVSync' Extension Next report