Breaches and incidentsBriefChecked against a primary source
CHOSEN BRICK: Iranian state spyware against dissidents and journalists (NCSC, FBI, AIVD)
Joint advisory: “Iranian state cyber actors” have used the Windows malware CHOSEN BRICK since at least 2025 against dissidents, activists and journalists...
- Disclosed
What happened
- Joint advisory: “Iranian state cyber actors” have used the Windows malware CHOSEN BRICK since at least 2025 against dissidents, activists and journalists in the UK, US and Netherlands; victims’ details later appeared on pro-Iranian leak sites.
- Technique: rapport over WhatsApp/Telegram posing as contacts or support, then fake apps (Telegram, KeePass, Norton) or “MRI results”; HKCU Run persistence, Defender exclusions, one Telegram bot per victim for C2; screenshots, mic, browser WhatsApp/Telegram data, email theft, wipe. FBI tracks a related family as Heavygram.
- Attribution: the three agencies; no specific Iranian agency named.
Sources
- https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists
- https://www.helpnetsecurity.com/2026/09/16/iranian-hackers-chosen-brick-malware-dissidents-journalists/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.