# Iranian State Actors Deploy CHOSEN BRICK Windows Malware to Spy on Dissidents, Activists, and Journalists

> Iranian state actors operating on behalf of Iran's Ministry of Intelligence and Security (MOIS) are using Windows spyware known as CHOSEN BRICK (FBI designation: HEAVYGRAM) to surveil dissidents, activists, and journalists in the US, UK, and Netherlands, per a joint 15 September 2026 NCSC/FBI/AIVD advisory. Victims are lured via WhatsApp/Telegram social engineering into installing trojanized apps, after which the malware harvests communications, screenshots, and audio over a per-victim Telegram-bot C2 channel and can fully wipe the infected device.

- **Published:** 2026-09-16T00:00:00Z
- **Last reviewed:** 2026-09-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2543
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-chosen-brick-activist-malware-tl-2026-2543.webp?v=0dd40031 (Threadlinqs threat intel: CHOSEN BRICK Activist Spyware: Detection & IOCs (TL-2026-2543) — High severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-2543
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Iran Ministry of Intelligence (Iran)
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

CHOSEN BRICK (tracked separately by the FBI as HEAVYGRAM, the same malware lineage first linked to activity dating to autumn 2023) is a Windows-only surveillance and data-theft implant deployed by Iranian state cyber actors operating for Iran's Ministry of Intelligence and Security (MOIS). A joint advisory published 15 September 2026 by the UK National Cyber Security Centre (NCSC), the US Federal Bureau of Investigation (via IC3, CSA 260915-2), and the Netherlands' General Intelligence and Security Service (AIVD) attributes an active campaign, documented since at least 2025, targeting dissidents, activists, and journalists in the US, UK, and Netherlands who are perceived as threats to the Iranian regime.

Operators build rapport with targets over WhatsApp and Telegram, impersonating trusted acquaintances or platform/IT technical-support representatives, before delivering a malicious file disguised as a legitimate application (Pictory, RunwayML, Norton Antivirus, Telegram itself, Adobe Flash Player, KeePass) or a fabricated document such as an MRI scan result. Corporate targets whose devices are protected by enterprise security controls are frequently redirected toward less-defended personal devices. Once executed, CHOSEN BRICK/HEAVYGRAM establishes persistence via the HKCU Run registry key (observed values SMQDService and winappx), guards against re-infection using hardcoded mutexes (ytyjyujyu, noi672pp434awkc12f), and adds Microsoft Defender exclusions to reduce the likelihood its files are scanned or removed.

The implant collects screenshots, microphone audio, running-process and system information, email content, and WhatsApp/Telegram browser chat data, and can download additional payloads. Command and control is conducted through per-victim Telegram bots (a unique bot ID per infected machine, preventing cross-victim contamination), with newer variants relaying that Telegram traffic through commercial HTTPS/SOCKS5 proxy services (IPRoyal, LightningProxies) to obscure the C2 channel; stolen data is also exfiltrated to legitimate cloud object-storage services (Backblaze B2, Vultr Object Storage, Storj). At least one observed variant carries a full data-wipe capability, giving operators a destructive option against journalists' and activists' devices in addition to ongoing surveillance.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1585.001 Social Media Accounts
- T1566.003 Spearphishing via Service
- T1204.002 Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1480.002 Mutual Exclusion
- T1685 Disable or Modify Tools
- T1057 Process Discovery
- T1082 System Information Discovery
- T1113 Screen Capture
- T1123 Audio Capture
- T1005 Data from Local System
- T1114.001 Local Email Collection
- T1102.002 Bidirectional Communication
- T1090.002 External Proxy
- T1567.002 Exfiltration to Cloud Storage
- T1485 Data Destruction

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CHOSEN BRICK HKCU Run-Key Persistence Followed by Process/System Discovery** (`TL-2026-2543-SPL-002`)

Detects creation of the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry values SMQDService or winappx (user-level autostart persistence) followed within a short window by tasklist/systeminfo-style process and system enumeration in the same host/user session -- the discovery activity CHOSEN BRICK performs immediately after establishing persistence to profile the compromised machine.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1547.001, T1057, T1082
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
| where TargetObject="*CurrentVersion\\Run\\SMQDService" OR TargetObject="*CurrentVersion\\Run\\winappx"
| rename Details as PersistTarget
| eval persist_time=_time
| join type=left host user
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\tasklist.exe" OR Image="*\\systeminfo.exe" OR CommandLine="*Win32_Process*" OR CommandLine="*Get-Process*" OR CommandLine="*Get-ComputerInfo*")
      | stats count as discovery_count earliest(_time) as discovery_time by host user ]
| table _time host user TargetObject PersistTarget discovery_count discovery_time
| sort -_time
```

### Microsoft KQL

```kql
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentVersion\Run" and RegistryValueName in~ ("SMQDService","winappx")
| project PersistTime=Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, RegistryValueName, RegistryValueData
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("tasklist.exe","systeminfo.exe","whoami.exe") or ProcessCommandLine has_any ("Win32_Process","Get-ComputerInfo","Get-Process")
    | project DiscTime=Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
) on DeviceName, AccountName
| where isempty(DiscTime) or DiscTime between (PersistTime .. PersistTime + 30m)
| project PersistTime, DiscTime, DeviceName, AccountName, RegistryValueName, RegistryValueData, FileName, ProcessCommandLine
| order by PersistTime desc
```

### Sigma

```yaml
title: CHOSEN BRICK Run-Key Persistence (SMQDService / winappx) with Post-Persistence Host Discovery
id: 7c1e4b2a-9a3d-4f5e-8b6c-1a2d3e4f5064
status: experimental
description: Detects creation of the reported CHOSEN BRICK Run-key values, optionally followed by host/process discovery commands.
references:
    - https://www.ic3.gov/CSA/2026/260915-2.pdf
author: AII-Detector -- ThreadLinqs Intelligence
date: 2026/09/16
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.discovery
    - attack.t1057
    - attack.t1082
    - attack.tool.chosen_brick
logsource:
    category: registry_set
    product: windows
detection:
    selection_persist:
        TargetObject|contains: 'CurrentVersion\Run\'
        TargetObject|endswith:
            - 'SMQDService'
            - 'winappx'
    condition: selection_persist
falsepositives:
    - Legitimate software coincidentally using the value name 'winappx' or 'SMQDService' (verify the target executable's path/hash against known-good vendors)
level: high
```

**Known false positives:**

- Legitimate application coincidentally using the generic value name 'winappx' or 'SMQDService' (rare; verify target executable path/hash)
- IT-run inventory/asset-discovery scripts (tasklist/systeminfo) scheduled around the same time -- correlate with known scan schedules before escalating

**Tuning notes:** The registry value names are hardcoded IOCs from a single observed campaign window; broaden by also alerting on any new HKCU Run value whose target path resolves to ProgramData or a 'MicrosoftDistribution'-style masquerading vendor folder, not just the exact value names, to catch renamed variants.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CHOSEN BRICK Dropped Payload Execution from Known Drop Paths / Space-Masqueraded Windows Directory (locked: unlock with TL Creds)
- CHOSEN BRICK Screen-Capture and Microphone-Audio Surveillance Collection (locked: unlock with TL Creds)
- Endpoint Egress to Commercial SOCKS5/HTTPS Proxy Services Preceding Telegram/Cloud-Storage Traffic (locked: unlock with TL Creds)
- CHOSEN BRICK Install-Time Defense Evasion -- Execution-Guardrail Mutex and Defender Exclusion Addition (locked: unlock with TL Creds)
- CHOSEN BRICK Local Email and WhatsApp/Telegram Chat-Data Harvesting (locked: unlock with TL Creds)
- CHOSEN BRICK Cloud-Object-Storage Exfiltration Followed by Mass File Deletion (Data-Wipe Indicator) (locked: unlock with TL Creds)
- CHOSEN BRICK Lure-Branded Installer Execution via WhatsApp/Telegram Delivery (locked: unlock with TL Creds)
- CHOSEN BRICK Per-Victim Telegram Bot API C2 Beaconing (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- Domain: `backblazeb2[.]com`
- Domain: `vultrobjects[.]com`
- Domain: `storjshare[.]io`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Iranian hackers use CHOSEN BRICK Windows malware to spy on targets](https://www.bleepingcomputer.com/news/security/iranian-hackers-use-chosen-brick-windows-malware-to-spy-on-targets/)
- [US, UK, Dutch Agencies Expose Iranian 'Chosen Brick' Surveillance Malware](https://www.securityweek.com/us-uk-dutch-agencies-expose-iranian-chosen-brick-surveillance-malware/)
- [Iranian cyber targeting of dissidents, activists and journalists](https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists)
- [UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists](https://www.ncsc.gov.uk/news/uk-allies-expose-spyware-iranian-state-actors-target-dissidents-activists-journalists)
- [Joint Cybersecurity Advisory: Iranian State Actor Use of CHOSEN BRICK / HEAVYGRAM Malware (IC3 CSA 260915-2)](https://www.ic3.gov/CSA/2026/260915-2.pdf)
- [Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results](https://gbhackers.com/chosen-brick-malware/)
- [CHOSEN BRICK Malware Lets Iranian State Hackers Steal Emails, WhatsApp and Telegram Data](https://cyberpress.org/chosen-brick-steals-messaging-data/)
- [Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists](https://thehackernews.com/2026/09/iranian-hackers-use-telegram-controlled.html)
- [NCSC and Allies Warn of Iranian Spyware Campaign](https://www.infosecurity-magazine.com/news/ncsc-allies-warn-iranian-chosen/)
- [FBI Details Iranian HEAVYGRAM Malware Campaign Targeting Dissidents and Journalists](https://www.hstoday.us/subject-matter-areas/cybersecurity/fbi-details-iranian-heavygram-malware-campaign-targeting-dissidents-and-journalists/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2543