CHOSEN BRICK: Iranian state cyber actors run Telegram-C2 Windows spyware against dissidents, activists and journalists, per joint NCSC-UK/FBI/AIVD advisory

NCSC UK, the US FBI and the Netherlands' AIVD jointly published a technical advisory on 2026-09-15 for CHOSEN BRICK, a Windows-only malware family Iranian state cyber actors have used since at least 2025 against dissidents, activists and journalists, targeting individuals around the world including in the UK, US and the Netherlands (NCSC UK, 2026-09-15). NCSC assesses Iran "almost certainly" uses cyber activity to support repression of people it sees as regime threats, and notes Iranian intelligence services have in some cases plotted kidnap or lethal operations against such people internationally (NCSC UK, 2026-09-15). NCSC UK's advisory does not itself name a specific Iranian government entity; The Record notes that the tradecraft closely matches activity the FBI attributed to actors operating "on behalf of the Government of Iran Ministry of Intelligence and Security" in a flash warning circulated in March 2026, which also linked a July 2025 hack-and-leak operation to the "Handala Hack" persona the FBI assesses MOIS operates and connects to a further group, "Homeland Justice" (The Record, 2026-09-15).

Access begins with rapport-building over messaging apps such as WhatsApp and Telegram, drawing on extensive prior research into the target, with the actor often posing as someone the target already knows or as the platform's technical support. The victim is then persuaded to download and open a file disguised as a legitimate application (observed lures include Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass) or as MRI scan results. A decoy screen matching the lure's theme displays while the core malware downloads and runs in the background. The actor often contacts the target's work device first and, if delivery fails or detection risk looks high, asks the target to open the file on a personal device instead, evading the corporate controls that protect them. In every observed instance the malware has targeted Windows only (NCSC UK, 2026-09-15).

CHOSEN BRICK persists across reboot via the registry Run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run, registers a mutex so only one copy runs, and adds Microsoft Defender exclusions to evade detection. Command and control runs over Telegram, with each victim device assigned its own unique Telegram Bot ID as an explicit operational-security measure to prevent cross-contamination between victims (NCSC UK, 2026-09-15); newer variants layer HTTPS/SOCKS5 proxies over that channel to further obscure it. No automated lateral-movement capability has been observed, though the malware can download and persist additional payloads through the same registry mechanism, making it technically possible.

Tasking supports process and system enumeration, screen capture, microphone capture, theft of Telegram/WhatsApp browser data and email content, file deletion and wiping the computer system. NCSC says screen capture is a data-theft feature commonly observed in these infections, which the actor can use to identify a victim's contacts, location and pattern of life (NCSC UK, 2026-09-15). Collected data exfiltrates through the Telegram bot or cloud object stores such as VultrObjects and StorjShare. NCSC states the most commonly observed additional-malware drop location is a lookalike of the system SysWOW64 directory under a folder named "Windows" with a trailing space, which NCSC states the actor created specifically for the purpose of deploying malware. NCSC adds that in at least one sample there was functionality for data wiping (NCSC UK, 2026-09-15). Some victims' personal data has since surfaced on pro-Iranian leak sites, which NCSC reads as a further harassment vector rather than incidental exposure (NCSC UK, 2026-09-15).