> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware
- URL: https://f4n6.co.uk/security-feed/us-uk-dutch-agencies-expose-iranian-chosen-brick-surveillance-malware/
- Published: 2026-09-16T15:34:23.000Z
- Updated: 2026-09-16T15:34:23.000Z
- Author: Jeff Davies
- Tags: #security-feed, Chosen Brick

## 1\. Executive summary

The FBI, UK NCSC and Netherlands AIVD have published a joint advisory on **CHOSEN BRICK**, a Windows-only surveillance and data-theft malware family used since at least 2025 against dissidents, activists and journalists, with delivery driven by WhatsApp/Telegram social engineering rather than by exploitation of a software vulnerability. The VERIFIED REFERENCE DATA records **no CVE, no CVSS score, no EPSS value and no CISA KEV entry** for this item — there is no exploited vulnerability to patch, and no remediation due-date applies; the exposure is malware execution on user endpoints. For EMEA financial services the risk is **targeted, not systemic**: the primary victims are individuals, but the agencies state that contact is frequently first attempted on a **corporate device**, with a deliberate pivot to the target's **personal device** when enterprise controls block delivery — so staff who are plausible targets carry the exposure into the corporate estate. Attribution to Iranian state cyber actors is made by three governments jointly and is treated here as corroborated at state level; **no MITRE ATT&CK profile exists for the named actor, so group-level attribution is unconfirmed** and we do not map this to a tracked APT designation.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

This is a government threat advisory about a malware family, not an incident at a client, and the trigger facts (a threat exists, endpoints need hardening, a third party published a report) would be true of virtually any advisory — mapping them to DORA or NIS2 would be compliance-checkbox padding. The one conditional worth stating: if a corporate device is confirmed compromised, the ordinary DORA Art. 17 / Art. 18 / Art. 19 incident-management, classification and reporting chain is engaged in the normal way, and NIS2 Art. 23 reporting applies to in-scope entities — but that is triggered by the incident, not by this advisory. The agencies' recommendation to circulate the advisory to likely-targeted staff and support them in checking **personal** devices is a staff-protection action; it does not, on its own, engage any article in the REGULATORY REFERENCE.

## 3\. Technical analysis & attack chain

### Confirmed attack chain

1. **Target research.** Operators conduct extensive pre-attack research on the individual, their contacts and relevant industry organisations, so that the opening message is credible. The agencies describe this preparation as "extensive."
2. **Initial contact via messaging platform.** Contact is initiated over **WhatsApp or Telegram**, purportedly from individuals or organisations the victim knows and trusts. In some reporting, operators pose as platform technical support representatives.
3. **Corporate-device-first approach.** Attackers frequently initiate contact through the target's **corporate device**; if security controls block delivery, they attempt to move the interaction to the individual's **personal device** to bypass enterprise protections.
4. **Delivery of a masqueraded file.** After rapport is established, the victim is persuaded to download and open a file that appears to be a legitimate application. Legitimate applications impersonated include **Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass**. Reporting also describes files disguised as **fake medical documentation, such as MRI scan results**.
5. **Execution with decoy.** On opening, the file displays a decoy screen while the malware executes in the background without the victim's knowledge.
6. **Persistence.** CHOSEN BRICK establishes persistence across reboots via the registry Run key: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
7. **Defence evasion.** The malware **adds exclusions to Microsoft Defender antivirus** in an attempt to evade detection.
8. **Command-and-control.** The implant connects to **Telegram** for C2 using a **victim-specific Telegram bot** — each infected endpoint is assigned a unique bot ID, which the agencies describe as operational-security hygiene to prevent cross-victim contamination.
9. **Collection.** Capabilities include enumerating running processes and system information, capturing **screen content**, recording **host audio via the microphone**, stealing **emails**, and extracting **Telegram and WhatsApp data from web browsers**.
10. **Exfiltration.** Exfiltration occurs through **Telegram infrastructure and cloud storage services**.
11. **Secondary payloads.** The malware downloads additional malware and sets up persistence for new payloads using the **same Run key** it uses for its own persistence, allowing operators to expand access manually.
12. **Destructive option.** Operators can execute commands to **wipe the computer system**.
13. **Lateral movement.** Not observed to be automated. The advisory notes automated lateral movement is "technically possible," and the secondary-payload capability lets operators expand access manually.

### Technical specifics relevant to defenders

- **Platform:** All observed infections are **Windows** systems. No other platform is described.
- **No exploited component.** The source material identifies no CVE, no vulnerable product version and no exploitation primitive. Initial access is entirely user-driven (social engineering → user opens file). This is why the VERIFIED REFERENCE DATA carries no CVSS, EPSS or KEV values.
- **Persistence artefact:** `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` — a per-user key, meaning persistence does not require administrative rights and survives reboot.
- **Evasion artefact:** Microsoft Defender exclusion entries added by the malware. The source does not specify the mechanism (API, PowerShell, registry) or the exclusion paths used, so no detection string can be derived for it beyond monitoring exclusion configuration changes.
- **C2 protocol:** Telegram bot API over the platform's normal infrastructure — traffic is TLS to legitimate Telegram endpoints, so network-layer blocking is a policy decision, not a signature match.
- **Data at risk:** contacts, emails, social media messages, browser-stored Telegram and WhatsApp chat data, screen and microphone content. The agencies state this is used to track an individual's movements and life patterns.

### Caveats and single-sourced claims

- **Attribution.** The joint advisory attributes the activity to **Iranian state cyber actors** and states Iran "almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime." This is a three-government statement and is treated as corroborated at that level. However, **the VERIFIED REFERENCE DATA contains no MITRE ATT&CK profile for the named actor**, so we make **no group-level attribution** and do not equate CHOSEN BRICK with any tracked APT designation. Treat any vendor naming of a specific Iranian group as unconfirmed.
- **Single-sourced (SecurityWeek):** the corporate-device-first / personal-device-pivot pattern, the "platform technical support" pretext, the fake MRI/medical-documentation lure, and the claim that stolen personal information is occasionally posted to pro-Iranian leak sites. These are plausible and consistent with the joint advisory's framing but appear in one source only — **verify before building controls or comms around them**.
- **Context, not this campaign:** the source material references Iranian-linked water and energy attacks and a UK power plant shutdown. The US and UK governments have **not** formally attributed those to Iran, and they are not part of the CHOSEN BRICK advisory. Do not conflate them.

## 4\. Mitigation & containment

There is **no vendor patch** for this item — CHOSEN BRICK is malware, not a vulnerability. Remediation is detection, removal and reimage; containment is control of delivery and C2.

### P1 — within 24 hours

1. **Hunt Run-key persistence.** On Windows endpoints, enumerate `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` for all users and flag values whose target binary sits in user-writable paths (`%APPDATA%`, `%LOCALAPPDATA%`, `%TEMP%`, `Downloads`). Remove unauthorised entries and preserve the binary for analysis before deletion.
2. **Audit Microsoft Defender exclusions.** Enumerate configured exclusions (paths, processes, extensions) using standard Defender tooling and remove any not covered by a documented change record. The advisory states CHOSEN BRICK adds exclusions to evade detection — an unexplained exclusion is a strong compromise signal.
3. **Alert on Telegram C2.** Where policy permits, alert on outbound Telegram traffic originating from processes that are not the sanctioned Telegram client, and on any endpoint process making repeated HTTPS connections to Telegram infrastructure. Blocking outright is a business decision — Telegram is a legitimate service and the malware uses its normal infrastructure.
4. **Circulate to likely-targeted staff.** The agencies explicitly recommend organisations circulate the advisory to staff likely to be targeted and support them in checking **personal** devices. Do this now, with a named contact for reporting.
5. **Preserve and escalate.** Any suspected execution: isolate the endpoint, do not power off (volatile memory holds the Telegram bot configuration), and escalate to incident response. Note the malware can wipe the system on operator command — treat suspected infections as time-critical.

### P2 — within 72 hours

1. **Targeted user awareness.** Brief staff on the specific lures: WhatsApp/Telegram approaches from apparent acquaintances or "platform support," and files presented as Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, KeePass, or medical documents such as MRI results. Instruct: never open installers received over messaging apps; obtain software only from the vendor's own site.
2. **EDR behavioural rules.** Alert on: unsigned or newly-created processes writing to the HKCU Run key; processes accessing browser chat-store data for Telegram/WhatsApp web sessions; microphone or screen-capture activity by unsigned processes; and any process spawning a system-wipe command.
3. **Personal-device guidance.** Publish a short note telling staff how to check personal Windows devices for unexpected startup entries and Defender exclusions, and how to report a suspected infection without fear of disciplinary consequence — the agencies' stated concern is that this actor targets personal devices, not just corporate ones.

### P3 — within 7 days

1. **Review the corporate/personal boundary.** The reported corporate-first, personal-pivot pattern means enterprise controls can be bypassed by moving the conversation off-network. Confirm your acceptable-use and BYOD position, and confirm that a compromise originating on a personal device but touching corporate data has a defined reporting path.
2. **Rehearse the reporting decision.** If a corporate device is confirmed compromised, confirm who classifies the incident and who notifies under DORA Art. 17/18/19 or NIS2 Art. 23 as applicable. Do not pre-classify this advisory as a reportable event — it is not one.

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

The joint advisory as reported publishes **no hashes, filenames, mutexes, domains, IP addresses or URLs**. The following are behavioural indicators only and are not machine-pivotable atomic indicators; no copyable indicator block is provided.

### Behavioural indicators

| behaviour                                                                                                 | where to observe                              | confidence                                                |
| --------------------------------------------------------------------------------------------------------- | --------------------------------------------- | --------------------------------------------------------- |
| New value under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run pointing to a user-writable path  | Windows registry telemetry / EDR              | High — corroborated across sources                        |
| Microsoft Defender exclusion added without a change record                                                | Defender configuration / EDR config telemetry | High — corroborated across sources                        |
| Outbound connections to Telegram infrastructure from a process that is not the sanctioned Telegram client | Network / proxy / firewall telemetry          | Medium — mechanism described, no infrastructure published |
| Victim-specific Telegram bot used for C2 (unique bot ID per endpoint)                                     | Network / proxy logs                          | Medium — mechanism described, no identifiers published    |
| Running-process and system-information enumeration by a recently delivered binary                         | EDR process telemetry                         | Medium                                                    |
| Screen capture and microphone audio recording by an unsigned process                                      | EDR / OS telemetry                            | Medium                                                    |
| Access to browser-stored Telegram and WhatsApp chat data                                                  | File-access telemetry                         | Medium                                                    |
| Secondary payload download followed by a further Run-key persistence entry                                | EDR + registry telemetry                      | Medium                                                    |
| Decoy window displayed while an installer executes in the background                                      | User reports / EDR                            | Medium — single-sourced (SecurityWeek)                    |

## 6\. Detection

The source material publishes no file hashes, filenames, mutexes or C2 infrastructure. The only file-level artefact disclosed is the registry Run key used for persistence. Both rules below are therefore **low-fidelity hunting aids requiring tuning and allowlisting** — they will fire on legitimate installers and updaters. They are not suitable for blocking.

```yara
rule CRIME_CHOSEN_BRICK_RunKey_Persistence
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-16"
        reference = "https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists"
        description = "Low-fidelity hunt rule for CHOSEN BRICK. The joint FBI/NCSC/AIVD advisory discloses no hashes, filenames or mutexes; the only file-level artefact is the HKCU Run key used for persistence. Expect false positives from legitimate installers - use for triage, not blocking."
        tlp = "AMBER"
    strings:
        $runkey_ascii = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
        $runkey_wide  = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
    condition:
        uint16(0) == 0x5A4D and any of them
}

```

```yaml
title: CHOSEN BRICK Persistence via HKCU Run Key
id: 8f2c1a44-7b6e-4d19-9c3a-0a5e6d2b7f10
status: experimental
description: >
    Detects writes to the per-user Run key used by CHOSEN BRICK for persistence across
    reboots, per the joint FBI/NCSC/AIVD advisory. Low fidelity on its own - correlate
    with the writing process residing in a user-writable path (%APPDATA%, %TEMP%,
    Downloads) and with Defender exclusion changes on the same host.
references:

    - https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists
    - https://www.theregister.com/security/2026/09/15/iranian-spies-hit-windows-machines-with-chosen-brick-data-stealing-malware/5296646
author: Adverse Trace
date: 2026/09/16
tags:

    - attack.persistence
    - attack.t1547.001
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Software\Microsoft\Windows\CurrentVersion\Run\'
    condition: selection
falsepositives:

    - Legitimate software installers and updaters registering Run-key autostart entries
level: low

```

**Not covered by rule:** the Defender exclusion modification and the Telegram C2 channel. The source does not disclose the exclusion mechanism, paths or any Telegram bot identifiers, so no reliable signature can be written. Monitor Defender exclusion configuration changes and anomalous Telegram egress through configuration baselines and network policy instead.

## 7\. Sources

- SecurityWeek — *US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware* — https://www.securityweek.com/us-uk-dutch-agencies-expose-iranian-chosen-brick-surveillance-malware/ — 2026-09-16
- The Register — *Iranian spies hit Windows machines with Chosen Brick data-stealing malware* — https://www.theregister.com/security/2026/09/15/iranian-spies-hit-windows-machines-with-chosen-brick-data-stealing-malware/5296646 — 2026-09-15
- UK NCSC — *Iranian cyber targeting of dissidents, activists and journalists* (joint advisory on CHOSEN BRICK, including technical analysis) — https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists

## 8\. Adverse Trace position

We assess CHOSEN BRICK as a **high-impact, low-prevalence targeted threat** with **no applicable CVSS score, no EPSS value and no CISA KEV entry** — it is not an exploited-vulnerability campaign and should not be triaged as one. For EMEA financial services institutions the systemic risk is low; the realistic risk is a small number of staff who are plausible targets for Iranian state interest (regional or diaspora-facing roles, policy, journalism-adjacent, human rights or sanctions work) being approached on a corporate device and, if blocked, on a personal one. The attribution to Iranian state cyber actors rests on a joint FBI/NCSC/AIVD statement and is treated as corroborated at state level; **no MITRE ATT&CK profile exists for the named actor, so we make no group-level attribution**, and the corporate-device-pivot, technical-support pretext, medical-document lure and leak-site claims are **single-sourced to SecurityWeek — verify before enforcement or external comms**. We will monitor the NCSC advisory page for a technical annex (hashes, filenames, C2 identifiers) and reissue this note if atomic indicators are published; in the meantime, clients should action the P1 Run-key and Defender-exclusion hunts, which are the only concrete detection opportunities the source material supports.

---

[Read the original source →](https://www.securityweek.com/us-uk-dutch-agencies-expose-iranian-chosen-brick-surveillance-malware/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*