UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists

1. Executive summary

The UK NCSC, the US FBI and the Netherlands' General Intelligence and Security Service have published a joint advisory exposing a Windows spyware family dubbed CHOSEN BRICK, used by actors attributed to the Iranian state to surveil dissidents, activists and journalists worldwide, including in the UK. Initial access is social engineering: operators impersonate the target's known contacts over WhatsApp and Telegram, build rapport, and lure the victim into installing the malware — in one documented case using fake MRI test results as the hook. CHOSEN BRICK is persistent across reboot and collects contacts, email and social-media messages, screen content and microphone audio; stolen material has surfaced on pro-Iranian leak sites, and victim personal details have been published, raising physical-safety risk. No CVE, CVSS score or CISA KEV entry applies to this item — it is a targeted surveillance campaign, not a software vulnerability — so the direct enterprise risk to most EMEA financial services firms is low; the material risk is to individual staff who fit the targeting profile (Iranian diaspora, dissidents, activists, journalists, human-rights and diaspora-community figures), and to their personal and corporate Windows devices. Attribution to "Iranian state actors" is unconfirmed in our verified reference data (no MITRE ATT&CK profile exists for that actor designation); the NCSC assesses Iran is "almost certainly" responsible.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The campaign targets individuals through personal messaging apps and Windows spyware; it involves no CVE, no ICT third-party provider and no supply-chain compromise at a financial entity, so none of the articles in the regulatory reference meet the distinctiveness test. DORA Art. 17–19 would only become engaged if a client's own ICT systems were compromised as a downstream consequence — a generic condition that does not justify a mapping here.

3. Technical analysis & attack chain

The source material is a government news release and joint advisory summary; it describes the campaign at capability level and does not publish atomic indicators, CVE references or version data. The following chain reflects confirmed, source-stated steps.

1. Target selection. Individuals perceived to pose a threat to the Iranian regime — dissidents, activists and journalists, including targets in the UK — are selected. The NCSC assesses Iran "almost certainly" uses cyber activity to support repression of such individuals.
2. Initial contact. Operators impersonate the target's existing contacts over messaging apps, specifically WhatsApp and Telegram, to establish trust.
3. Rapport building / social engineering. The actors tailor their approach to the target's interests and have used fabricated content as a lure — the source cites fake MRI test results as a documented hook.
4. Delivery. The target is tricked into downloading and installing software (spear-phishing), which delivers the CHOSEN BRICK payload.
5. Execution and persistence. CHOSEN BRICK runs on Windows only. It is persistent and survives a reboot of the target device.
6. Collection. The malware collects the target's contacts, emails and social-media messages, and includes functionality to capture screen content and access the device microphone (enabling tracking of the target's movements).
7. Exfiltration and impact. Stolen sensitive information has appeared on leak sites; personal details of some previous victims have been published on pro-Iranian leak sites, potentially increasing the risk to their personal safety.

Technical specifics that matter to a defender: the malware is Windows-exclusive and reboot-persistent; its collection surface is broad (messaging/email content, screen, microphone). The source does not disclose the persistence mechanism (service, scheduled task, Run key, etc.), the C2 protocol or infrastructure, file names, paths, hashes, or the delivery file format. Those details are expected in the full joint advisory, which is referenced but whose technical annex was not available in the source material supplied.

Caveated / unconfirmed points. Attribution to "Iranian state actors" is unconfirmed in our verified reference data — there is no MITRE ATT&CK profile for that actor designation — and rests on the joint advisory's assessment (NCSC: Iran "almost certainly" responsible). All technical capability detail above is single-sourced to the joint NCSC/FBI/Netherlands advisory; treat it as authoritative for capability but verify against the full advisory before building enforcement. No exploitation of a specific CVE is described, and none should be inferred.

4. Mitigation & containment

The campaign targets individuals, so the priority actions are personnel-focused and endpoint-hardening rather than patch management.

P1 — within 24 hours

• Identify staff who fit the targeting profile (Iranian diaspora, dissidents, activists, journalists, human-rights and diaspora-community figures) and issue a targeted briefing on the impersonation-over-WhatsApp/Telegram technique and the "known contact" trust hook.
• Instruct at-risk staff not to install software sent by unsolicited or unexpected contacts, even when the sender appears to be a known contact, and to verify out-of-band before acting on any file or link.
• Confirm EDR/AV is active and tamper-protected on all Windows endpoints, with behavioural alerting for microphone access and screen-capture activity by non-approved processes.
• Point at-risk individuals to the NCSC's dedicated support for high-risk individuals, including its free cyber defence services, as recommended in the advisory.

P2 — within 72 hours

• Review and communicate policy on personal messaging apps on corporate Windows devices; where policy permits, require that files received via WhatsApp/Telegram are not opened on corporate endpoints.
• Ensure Windows endpoints have application allowlisting or equivalent controls so that user-initiated installs of unapproved binaries are blocked or alerted.
• Verify that reboot-persistence locations (Run/RunOnce keys, services, scheduled tasks, startup folders) are covered by monitoring, since CHOSEN BRICK survives reboot.

P3 — within 7 days

• Run an awareness exercise on tailored social-engineering lures (including the fake-medical-results pattern) for staff in high-risk roles.
• Ingest the full joint advisory's technical annex and mitigation steps when available; update detection content and this advisory accordingly.

No vendor patch or version fix applies — there is no CVE in this item.

5. Indicators of compromise

No indicators of compromise available in the source material.

The source describes observable behaviours but publishes no atomic indicators (no hashes, domains, IPs, file paths or registry keys). The behaviours below are source-stated capabilities, not machine-pivotable artefacts, and are therefore not placed in a copyable block.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The source contains no threat artefacts usable for detection — no file names, paths, registry keys, mutexes, command-line flags, hashes or network values. The only named string, "CHOSEN BRICK", is a reporting codename for the malware family, not an artefact of the malware itself, and a rule matching it would detect reporting about the threat rather than the threat.

7. Sources

• NCSC, "UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists", https://www.ncsc.gov.uk/news/uk-allies-expose-spyware-iranian-state-actors-target-dissidents-activists-journalists, 2026-09-15.
• Joint advisory by the NCSC, the US FBI and the Netherlands' General Intelligence and Security Service — referenced in the source above; technical annex and URL not provided in the source material.

8. Adverse Trace position

This is a targeted, state-attributed surveillance campaign against individuals, not an enterprise vulnerability, and we do not inflate it: there is no CVE, no CVSS score and no CISA KEV entry, and the direct risk to most EMEA financial services firms is low. The material exposure is to specific staff who fit the targeting profile and to their Windows devices, with a secondary physical-safety dimension given that victim personal details have appeared on pro-Iranian leak sites. Attribution to "Iranian state actors" is unconfirmed in our verified reference data (no MITRE ATT&CK profile exists for that designation) and rests on the joint advisory's assessment; all technical capability detail is single-sourced to that advisory — verify before building enforcement. We will ingest the full joint advisory's technical annex when available, extract any atomic indicators and persistence mechanisms, and reissue this advisory with detection content; in the interim, clients should action the P1 personnel briefing and endpoint behavioural alerting in §4.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.