UK and allies expose Iranian CHOSEN BRICK spyware targeting dissidents
UK, US, and Dutch agencies describe spyware used by Iran to track journalists and activists through social engineering and fake applications.
The UK National Cyber Security Centre (NCSC), FBI, and Dutch AIVD have exposed 'CHOSEN BRICK' spyware used by Iranian state actors since at least 2025 to target dissidents, activists, and journalists [2, 5].
The malware is part of transnational repression, where foreign states direct crimes against individuals perceived as threats to their regime [6]. The NCSC stated, "Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime" [5].
Windows-exclusive targeting
Iranian state actors have used CHOSEN BRICK since at least 2025 to target individuals in the US, UK, and Netherlands [2]. The malware exclusively targets the Windows operating system [2, 5].
Attackers build rapport with targets via messaging applications before delivering the spyware [2]. Lures include fake applications appearing to be Norton Antivirus, Telegram, Adobe Flash Player, RunwayML, Pictory, or KeePass [2]. Some attackers used fake MRI scan results to trick victims into downloading files [2, 5].
Data theft and persistence
According to the NCSC, CHOSEN BRICK allows for the collection of a target's emails, contacts, and social media messages, which could be used to track their movements [2]. It can access the device microphone and capture screen content [5]. The malware survives reboots by using Windows registry keys [2].
For command and control, the malware connects to Telegram bots [2]. Each victim is assigned a unique Bot ID to prevent cross-contamination [2]. Data is exfiltrated via these bots and cloud object stores including VultrObjects and StorjShare [2].
Safety risks
The NCSC and its partners report that personal details of some victims have been published on pro-Iranian leak sites [2, 5]. Iranian intelligence has also plotted international kidnappings or lethal operations against perceived enemies [2].
Detection and monitoring
Security teams should monitor for indicators of compromise provided in the joint advisory [2]. These include unexpected connections to Telegram bots or files in the non-standard directory "C:\Windows \SysWOW64" [2].
What we don't know
- The total number of individuals compromised by CHOSEN BRICK [2, 5].
- The exact number of victims whose data appeared on leak sites [2, 5].
- The specific count of plotted lethal operations or kidnappings, or how many were attempted [2].
