Iranian State-Sponsored Surveillance Malware: Chosen Brick

Since at least 2025, Iranian state-sponsored actors have deployed a Windows-based surveillance malware family dubbed 'Chosen Brick' to target dissidents, activists, and journalists worldwide. The threat actors engage targets through messaging platforms like WhatsApp and Telegram, often masquerading as acquaintances or technical support personnel to build rapport. The campaign focuses on harvesting sensitive data, including contact lists, emails, and social media messages, to track the targets' physical location and life patterns. In instances where corporate security controls prevent initial infection, the actors actively maneuver the target toward using personal devices to bypass enterprise-grade protections. The surveillance data is subsequently used for harassment, with stolen information occasionally posted to pro-Iranian leak sites to intimidate victims.

Attack Chain

1. Initial contact is established via messaging platforms (WhatsApp or Telegram) using social engineering to build trust.
2. Attackers deliver weaponized files disguised as legitimate utility software or medical documentation (e.g., MRI scan results).
3. The victim executes the malicious file, which triggers a decoy document while the malware runs in the background.
4. Chosen Brick establishes persistence on the host by creating entries in Windows Registry Run keys.
5. The malware performs defense evasion by programmatically adding itself to Microsoft Defender exclusion lists.
6. The malware registers with a unique Telegram bot ID to initiate C2 communication.
7. The operator exfiltrates data or executes secondary payloads to gain further control over the host.

Impact

The Chosen Brick campaign represents a targeted surveillance operation supporting state-sponsored repression. Victims include individuals perceived as threats to the Iranian regime, such as journalists and activists. The malware enables comprehensive spying capabilities including microphone audio recording, screenshot capture, credential harvesting from browser data, and data wiping. The public release of stolen personal information on leak sites has been observed as a tactic to harass and silence targeted individuals.

Recommendation

• Deploy the provided Sigma rule to detect suspicious Registry Run key modifications that attempt to facilitate malware persistence.
• Monitor for unauthorized modifications to Microsoft Defender exclusion lists via Group Policy or local security log auditing.
• Enhance endpoint visibility to detect unusual communication patterns associated with Telegram bot API endpoints (api.telegram.org) from non-browser processes.
• Advise personnel to avoid opening files from unverified messaging platform contacts and discourage the use of personal devices for accessing sensitive corporate communications.