Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’

1. Executive summary

On 15 September 2026 the UK NCSC, the US FBI and the Netherlands AIVD issued a joint alert exposing CHOSEN BRICK, a Windows spyware tool used by Iranian state-sponsored operators against individuals perceived as threats to the regime — dissidents, activists and journalists. Delivery is highly targeted: operators make first contact over WhatsApp or Telegram posing as a known contact or as technical support, build rapport, then send a malicious file disguised to match the pretext (a fake MRI scan of a disk herniation, or installers impersonating Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass). The malware harvests contacts, email inboxes, social-media messages, screen content and microphone audio, persists across reboots, blinds Microsoft Defender with exclusions, and uses a per-victim Telegram bot for command and control and exfiltration. No CVE, CVSS score or CISA KEV entry applies — this is a social-engineering-led espionage campaign, not an exploited software vulnerability, so there is no patch to prioritise. Direct risk to most EMEA financial services firms is low; it rises for institutions employing staff who may be individually targeted, and the NCSC explicitly warns attackers may push victims onto personal devices to bypass workplace security.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The campaign targets individuals, not the ICT systems, third-party arrangements or supply chains of financial entities; no client incident, third-party dependency or supply-chain event is described. DORA Art. 17–19 would only become engaged if a targeted employee's compromise extended to corporate systems and met the entity's own classification threshold — a conditional outcome, not a trigger present in this item.

3. Technical analysis & attack chain

The agencies describe a core attack pattern with wide variation in how each compromise begins, because operators tailor the approach to each individual target. Confirmed steps:

1. Initial contact — operators reach the target over messaging platforms, principally WhatsApp and Telegram, often posing as a known contact or as technical support.
2. Rapport building — extensive social engineering to earn the target's trust before any payload is sent.
3. Delivery — a malicious file is sent, disguised to match the pretext. Observed lures include a fake MRI scan of a disk herniation, and files impersonating legitimate products: Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass.
4. Execution / installation — CHOSEN BRICK is Windows-only.
5. Persistence — the malware is designed to survive reboot by relaunching at login.
6. Defence evasion — it adds exclusions to Microsoft Defender to reduce the chance of detection.
7. Command and control — the malware uses Telegram for C2. Each victim is assigned a separate Telegram bot, limiting the risk that one compromised device exposes others.
8. Collection — CHOSEN BRICK harvests a wide range of material: contacts, email inboxes and social-media messages, and can capture screen content and switch on the device microphone.
9. Exfiltration — stolen files are sent through Telegram alongside other commercial cloud-storage services. The most recent versions of the spyware use proxies to conceal traffic.

Why this matters beyond the endpoint. The agencies warn the harvested data is used to build a pattern of life — a map of the victim's location, contacts and daily routine — which increases the physical risk to the affected person. The advisory states that personal details stolen this way have surfaced on pro-Iranian leak sites to further harass victims. The NCSC also warned that attackers may try to move targets onto personal devices to bypass workplace security, and urged organisations with at-risk staff to share the warning and help employees check their own phones and computers.

Attribution — unconfirmed. The NCSC did not identify a specific Iranian government entity behind the campaign. The tradecraft closely matches activity the FBI attributed in a March flash warning to actors operating "on behalf of the Government of Iran Ministry of Intelligence and Security" (MOIS); the FBI said similar Telegram-based malware had targeted Iranian dissidents and journalists since fall 2023, and linked a July 2025 hack-and-leak operation to the persona "Handala Hack," which the bureau assesses is operated by MOIS and connected to another group, "Homeland Justice." The US State Department also reissued a reward offer in March (the source text is truncated at "$10 mill…"). Per our verified reference data, the actor "Iranian cyber spies" has no MITRE ATT&CK profile, so we treat the state attribution as unconfirmed and note that the MOIS linkage is the FBI's assessment, not a corroborated fact.

Confidence caveat. The technical detail above rests on a single secondary source — The Record's rendering of a joint NCSC/FBI/AIVD advisory that we have not independently reviewed. The underlying alert is multi-agency, but the specific capability list (Defender exclusions, per-victim Telegram bots, proxy use in recent versions) should be treated as single-sourced; verify against the primary advisory before enforcement.

4. Mitigation & containment

There is no vendor patch — this is a social-engineering and spyware problem, so controls are behavioural, endpoint and egress.

P1 — within 24 hours

• Audit Microsoft Defender exclusions on all managed Windows endpoints. Unauthorised exclusions are the malware's stated evasion step. Run: Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess, ExclusionIpAddress Remove anything not under change control and investigate how it was added.
• Hunt for login persistence. Check HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, the matching RunOnce keys, the per-user and all-users Startup folders, and scheduled tasks for entries that relaunch at logon.
• Restrict or alert on unauthorised messaging clients (Telegram, WhatsApp desktop) on managed endpoints where policy permits; at minimum, alert on their installation and execution.
• Egress monitoring for Telegram bot API traffic and for unexpected uploads to commercial cloud-storage services from endpoints.

P2 — within 72 hours

• Circulate the NCSC/FBI/AIVD advisory to at-risk staff and run the NCSC's device-check guidance on their personal phones and computers, per the agency's explicit recommendation.
• Alert on endpoint proxy use — recent CHOSEN BRICK versions use proxies to hide C2 and exfiltration.
• Stand up a user-reporting path for suspicious medical-result attachments or unexpected software installers received over WhatsApp/Telegram.

P3 — within 7 days

• Identify staff who may be individually at risk and consider enhanced protection for them and their personal devices.
• Tabletop the personal-device bypass scenario — the NCSC's warning that attackers move targets off corporate infrastructure specifically to evade workplace controls.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources describe observable behaviours but no atomic indicators (no hashes, domains, IPs, filenames, mutexes or registry keys).

Behavioural indicators

6. Detection

No file-level artefacts (hashes, distinctive strings, filenames, mutexes, registry keys or command-line flags) are present in the source material, so no YARA rule is emitted. Behavioural indicators are sufficient for Sigma.

title: Microsoft Defender Exclusion Added via PowerShell
id: 8f2c1a44-7b6e-4d19-9c3a-5e0b1d7a2f10
status: experimental
description: Detects addition of Microsoft Defender exclusions via PowerShell, a defence-evasion step used by the CHOSEN BRICK spyware tool.
author: Adverse Trace
date: 2026/09/15
references:

  - https://therecord.media/iran-cyber-spies-use-fake-mri-scans-as-lure
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:

    - Image|endswith: '\powershell.exe'
    - Image|endswith: '\pwsh.exe'
  selection_cmdlet:
    CommandLine|contains:

      - 'Add-MpPreference'
      - 'Set-MpPreference'
  selection_exclusion:
    CommandLine|contains:

      - '-ExclusionPath'
      - '-ExclusionExtension'
      - '-ExclusionProcess'
  condition: selection_img and selection_cmdlet and selection_exclusion
falsepositives:

  - Legitimate administrative or software-deployment activity
level: high

title: Microsoft Defender Exclusion Registry Key Modified
id: 3d9b6e21-4a5c-4f88-b0e7-1c2a9d6f4b73
status: experimental
description: Detects modification of Microsoft Defender exclusion registry keys, consistent with the defence-evasion behaviour of the CHOSEN BRICK spyware tool.
author: Adverse Trace
date: 2026/09/15
references:

  - https://therecord.media/iran-cyber-spies-use-fake-mri-scans-as-lure
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|startswith: 'HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\'
  condition: selection
falsepositives:

  - Legitimate administrative or software-deployment activity
level: high

7. Sources

• The Record — Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’ — https://therecord.media/iran-cyber-spies-use-fake-mri-scans-as-lure — 2026-09-15
• Joint advisory by the UK NCSC, US FBI and Netherlands AIVD (referenced within the above; primary URL not provided in the source material)

8. Adverse Trace position

No CVSS score, severity rating or CISA KEV state applies to this item — there is no CVE, and we will not manufacture a severity number for a social-engineering-led espionage campaign. Our assessment: low direct risk to most EMEA financial services clients, rising to elevated for institutions employing staff who may be individually targeted (for example, Iranian diaspora employees, or staff with a public profile on Iranian regime-related issues), where the physical-safety dimension of the NCSC warning is the material concern rather than data loss. The attribution to Iranian state actors is unconfirmed in our verified reference data (no MITRE ATT&CK profile for the named actor); the MOIS linkage is the FBI's assessment relayed by a single secondary source, and the technical capability detail is single-sourced — verify against the primary NCSC/FBI/AIVD advisory before enforcement. Next: we will obtain and review the primary joint advisory, extract any atomic indicators it contains, and reissue this note if the indicator set materially changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.