> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’
- URL: https://f4n6.co.uk/security-feed/iranian-cyber-spies-used-fake-mri-scan-results-to-hack-enemy-of-regime/
- Published: 2026-09-15T18:11:03.000Z
- Updated: 2026-09-15T18:11:03.000Z
- Author: Jeff Davies
- Tags: #security-feed, Iranian cyber spies

## 1\. Executive summary

On 15 September 2026 the UK NCSC, the US FBI and the Netherlands AIVD issued a joint alert exposing **CHOSEN BRICK**, a Windows spyware tool used by Iranian state-sponsored operators against individuals perceived as threats to the regime — dissidents, activists and journalists. Delivery is highly targeted: operators make first contact over WhatsApp or Telegram posing as a known contact or as technical support, build rapport, then send a malicious file disguised to match the pretext (a fake MRI scan of a disk herniation, or installers impersonating Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass). The malware harvests contacts, email inboxes, social-media messages, screen content and microphone audio, persists across reboots, blinds Microsoft Defender with exclusions, and uses a per-victim Telegram bot for command and control and exfiltration. **No CVE, CVSS score or CISA KEV entry applies** — this is a social-engineering-led espionage campaign, not an exploited software vulnerability, so there is no patch to prioritise. Direct risk to most EMEA financial services firms is low; it rises for institutions employing staff who may be individually targeted, and the NCSC explicitly warns attackers may push victims onto personal devices to bypass workplace security.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The campaign targets individuals, not the ICT systems, third-party arrangements or supply chains of financial entities; no client incident, third-party dependency or supply-chain event is described. DORA Art. 17–19 would only become engaged if a targeted employee's compromise extended to corporate systems and met the entity's own classification threshold — a conditional outcome, not a trigger present in this item.

## 3\. Technical analysis & attack chain

The agencies describe a **core attack pattern** with wide variation in how each compromise begins, because operators tailor the approach to each individual target. Confirmed steps:

1. **Initial contact** — operators reach the target over messaging platforms, principally **WhatsApp and Telegram**, often posing as a known contact or as technical support.
2. **Rapport building** — extensive social engineering to earn the target's trust before any payload is sent.
3. **Delivery** — a malicious file is sent, disguised to match the pretext. Observed lures include a **fake MRI scan of a disk herniation**, and files impersonating legitimate products: **Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass**.
4. **Execution / installation** — CHOSEN BRICK is **Windows-only**.
5. **Persistence** — the malware is designed to survive reboot by **relaunching at login**.
6. **Defence evasion** — it **adds exclusions to Microsoft Defender** to reduce the chance of detection.
7. **Command and control** — the malware uses **Telegram** for C2\. Each victim is assigned a **separate Telegram bot**, limiting the risk that one compromised device exposes others.
8. **Collection** — CHOSEN BRICK harvests a wide range of material: **contacts, email inboxes and social-media messages**, and can **capture screen content** and **switch on the device microphone**.
9. **Exfiltration** — stolen files are sent through **Telegram** alongside **other commercial cloud-storage services**. The most recent versions of the spyware use **proxies to conceal traffic**.

**Why this matters beyond the endpoint.** The agencies warn the harvested data is used to build a **pattern of life** — a map of the victim's location, contacts and daily routine — which increases the *physical* risk to the affected person. The advisory states that personal details stolen this way have surfaced on **pro-Iranian leak sites** to further harass victims. The NCSC also warned that attackers may try to **move targets onto personal devices to bypass workplace security**, and urged organisations with at-risk staff to share the warning and help employees check their own phones and computers.

**Attribution — unconfirmed.** The NCSC did **not** identify a specific Iranian government entity behind the campaign. The tradecraft closely matches activity the FBI attributed in a March flash warning to actors operating "on behalf of the Government of Iran Ministry of Intelligence and Security" (MOIS); the FBI said similar Telegram-based malware had targeted Iranian dissidents and journalists since fall 2023, and linked a July 2025 hack-and-leak operation to the persona **"Handala Hack,"** which the bureau assesses is operated by MOIS and connected to another group, **"Homeland Justice."** The US State Department also reissued a reward offer in March (the source text is truncated at "$10 mill…"). Per our verified reference data, the actor "Iranian cyber spies" has **no MITRE ATT&CK profile**, so we treat the state attribution as **unconfirmed** and note that the MOIS linkage is the FBI's assessment, not a corroborated fact.

**Confidence caveat.** The technical detail above rests on a **single secondary source** — The Record's rendering of a joint NCSC/FBI/AIVD advisory that we have not independently reviewed. The underlying alert is multi-agency, but the specific capability list (Defender exclusions, per-victim Telegram bots, proxy use in recent versions) should be treated as **single-sourced; verify against the primary advisory before enforcement**.

## 4\. Mitigation & containment

There is no vendor patch — this is a social-engineering and spyware problem, so controls are behavioural, endpoint and egress.

### P1 — within 24 hours

- **Audit Microsoft Defender exclusions on all managed Windows endpoints.** Unauthorised exclusions are the malware's stated evasion step. Run: `Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess, ExclusionIpAddress` Remove anything not under change control and investigate how it was added.
- **Hunt for login persistence.** Check `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`, the matching `RunOnce` keys, the per-user and all-users Startup folders, and scheduled tasks for entries that relaunch at logon.
- **Restrict or alert on unauthorised messaging clients** (Telegram, WhatsApp desktop) on managed endpoints where policy permits; at minimum, alert on their installation and execution.
- **Egress monitoring** for Telegram bot API traffic and for unexpected uploads to commercial cloud-storage services from endpoints.

### P2 — within 72 hours

- **Circulate the NCSC/FBI/AIVD advisory to at-risk staff** and run the NCSC's device-check guidance on their personal phones and computers, per the agency's explicit recommendation.
- **Alert on endpoint proxy use** — recent CHOSEN BRICK versions use proxies to hide C2 and exfiltration.
- **Stand up a user-reporting path** for suspicious medical-result attachments or unexpected software installers received over WhatsApp/Telegram.

### P3 — within 7 days

- **Identify staff who may be individually at risk** and consider enhanced protection for them and their personal devices.
- **Tabletop the personal-device bypass scenario** — the NCSC's warning that attackers move targets off corporate infrastructure specifically to evade workplace controls.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The sources describe observable behaviours but no atomic indicators (no hashes, domains, IPs, filenames, mutexes or registry keys).

### Behavioural indicators

| Behaviour                                                                                                                                | Where to observe                                               | Confidence                                    |
| ---------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | --------------------------------------------- |
| First contact via WhatsApp/Telegram posing as a known contact or technical support                                                       | Messaging platform logs; user reports                          | High (multi-agency alert)                     |
| Malicious file disguised as an MRI scan or as Pictory / RunwayML / Norton Antivirus / Telegram / Adobe Flash Player / KeePass installers | Email and messaging attachment telemetry; file-download events | High (multi-agency alert)                     |
| Malware relaunches at login to survive reboot                                                                                            | Run/RunOnce keys, Startup folders, scheduled tasks, autoruns   | High (multi-agency alert)                     |
| Microsoft Defender exclusions added                                                                                                      | Defender configuration-change events; Get-MpPreference output  | High (multi-agency alert)                     |
| Telegram-based C2, one bot per victim                                                                                                    | Network egress to Telegram; proxy logs                         | High (multi-agency alert)                     |
| Exfiltration via Telegram and commercial cloud-storage services                                                                          | Egress volume and destination telemetry                        | High (multi-agency alert)                     |
| Proxy use to conceal C2/exfiltration traffic                                                                                             | Endpoint and proxy logs                                        | Medium (source states "most recent versions") |

## 6\. Detection

No file-level artefacts (hashes, distinctive strings, filenames, mutexes, registry keys or command-line flags) are present in the source material, so no YARA rule is emitted. Behavioural indicators are sufficient for Sigma.

```yaml
title: Microsoft Defender Exclusion Added via PowerShell
id: 8f2c1a44-7b6e-4d19-9c3a-5e0b1d7a2f10
status: experimental
description: Detects addition of Microsoft Defender exclusions via PowerShell, a defence-evasion step used by the CHOSEN BRICK spyware tool.
author: Adverse Trace
date: 2026/09/15
references:

  - https://therecord.media/iran-cyber-spies-use-fake-mri-scans-as-lure
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:

    - Image|endswith: '\powershell.exe'
    - Image|endswith: '\pwsh.exe'
  selection_cmdlet:
    CommandLine|contains:

      - 'Add-MpPreference'
      - 'Set-MpPreference'
  selection_exclusion:
    CommandLine|contains:

      - '-ExclusionPath'
      - '-ExclusionExtension'
      - '-ExclusionProcess'
  condition: selection_img and selection_cmdlet and selection_exclusion
falsepositives:

  - Legitimate administrative or software-deployment activity
level: high

```

```yaml
title: Microsoft Defender Exclusion Registry Key Modified
id: 3d9b6e21-4a5c-4f88-b0e7-1c2a9d6f4b73
status: experimental
description: Detects modification of Microsoft Defender exclusion registry keys, consistent with the defence-evasion behaviour of the CHOSEN BRICK spyware tool.
author: Adverse Trace
date: 2026/09/15
references:

  - https://therecord.media/iran-cyber-spies-use-fake-mri-scans-as-lure
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|startswith: 'HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\'
  condition: selection
falsepositives:

  - Legitimate administrative or software-deployment activity
level: high

```

## 7\. Sources

- The Record — *Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’* — https://therecord.media/iran-cyber-spies-use-fake-mri-scans-as-lure — 2026-09-15
- Joint advisory by the UK NCSC, US FBI and Netherlands AIVD (referenced within the above; primary URL not provided in the source material)

## 8\. Adverse Trace position

No CVSS score, severity rating or CISA KEV state applies to this item — there is no CVE, and we will not manufacture a severity number for a social-engineering-led espionage campaign. Our assessment: **low direct risk to most EMEA financial services clients**, rising to **elevated for institutions employing staff who may be individually targeted** (for example, Iranian diaspora employees, or staff with a public profile on Iranian regime-related issues), where the physical-safety dimension of the NCSC warning is the material concern rather than data loss. The attribution to Iranian state actors is **unconfirmed** in our verified reference data (no MITRE ATT&CK profile for the named actor); the MOIS linkage is the FBI's assessment relayed by a single secondary source, and the technical capability detail is **single-sourced — verify against the primary NCSC/FBI/AIVD advisory before enforcement**. Next: we will obtain and review the primary joint advisory, extract any atomic indicators it contains, and reissue this note if the indicator set materially changes.

---

[Read the original source →](https://therecord.media/iran-cyber-spies-use-fake-mri-scans-as-lure?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*