Actor Profile

Iranian state cyber actors are attributed by NCSC UK, FBI, and AIVD to deploying CHOSEN BRICK malware against dissidents, activists, and journalists perceived as threats to the Iranian regime. The actors operate from at least 2025, targeting individuals in the UK, US, Netherlands, and globally. Iran almost certainly uses cyber operations to support repression of regime critics, with intelligence services previously plotting kidnapping or lethal operations against perceived enemies internationally. Stolen victim data has appeared on pro-Iranian leak sites, escalating physical risk to targets.

TTPs (Tactics, Techniques, Procedures)

Initial access via social engineering on WhatsApp and Telegram (T1566.003), impersonating trusted contacts or platform support. Reconnaissance includes extensive target research (T1589). Delivery uses user execution of malicious files disguised as legitimate applications or documents (T1204.002). Persistence via registry Run keys (T1547.001). Defense evasion through Microsoft Defender exclusions (T1685). C2 via Telegram bots (T1102.002) with unique bot IDs per victim for OPSEC. Collection capabilities include process enumeration (T1057), system discovery (T1082), screen capture (T1113), audio recording (T1123), browser data theft targeting Telegram/WhatsApp (T1005), and email theft (T1114.001). Impact functions include file deletion and system wiping (T1485). Malware can download additional payloads and establish persistence for secondary malware.

Targets & Patterns

Targets are Iranian dissidents, activists, and journalists globally, including individuals in the UK, US, and Netherlands. Actors conduct extensive pre-operational research to tailor social engineering approaches. Initial contact often targets work or corporate devices; if delivery fails or detection risk is high, actors pivot to personal devices to evade corporate security controls. Targeting pattern reflects regime priorities to monitor, track, and potentially endanger individuals critical of Iranian government. Publication of victim data on leak sites suggests intent to intimidate and increase physical risk beyond cyber intrusion.

Historical Context

CHOSEN BRICK has been active from at least 2025. Personal details of previous victims have appeared on pro-Iranian leak sites. The advisory notes that Iranian intelligence services have historically plotted kidnapping or lethal operations against perceived regime enemies internationally, indicating cyber operations are part of broader transnational repression efforts. This represents continuation of Iran's documented pattern of using cyber capabilities to support physical threats against dissidents abroad.

Defensive Recommendations

  • Monitor for registry persistence in HKCU\Software\Microsoft\Windows\CurrentVersion\Run and alert on unexpected entries, particularly those executing from user-writable directories (T1547.001)
  • Detect unauthorized modifications to Microsoft Defender exclusions via Group Policy auditing or EDR telemetry (T1685)
  • Baseline and alert on anomalous Telegram API traffic patterns, especially connections to Telegram Bot API endpoints from non-browser processes (T1102.002)
  • Implement application control policies to prevent execution of unsigned or untrusted binaries, particularly those masquerading as legitimate software (Norton, Adobe, KeePass, etc.)
  • Conduct user awareness training for high-risk individuals on social engineering via messaging platforms, emphasizing verification of sender identity through out-of-band channels before opening files
  • Enable tamper protection for endpoint security products and monitor for process enumeration (T1057) or screen capture activity (T1113) from unexpected processes

---

# Geopolitical Context

Geopolitical Context

The CHOSEN BRICK campaign represents a continuation of Iran's transnational repression strategy, leveraging cyber capabilities to monitor and potentially endanger individuals perceived as threats to the regime. The joint advisory from the UK NCSC, US FBI, and Netherlands AIVD signals coordinated Western intelligence concern over Iran's use of surveillance malware against dissidents, activists, and journalists across multiple jurisdictions. The disclosure that victim data has appeared on pro-Iranian leak sites underscores the operational linkage between cyber espionage and potential physical threats—consistent with documented Iranian intelligence service plots involving kidnapping and lethal operations against perceived enemies abroad. This activity reflects Iran's broader strategy of using digital tools to extend state control beyond its borders, targeting diaspora communities and opposition figures in Western democracies where they might otherwise operate freely.

State Actor Alignment

The malware is attributed to Iranian state cyber actors by the UK National Cyber Security Centre, US Federal Bureau of Investigation, and Netherlands General Intelligence and Security Service (AIVD). The advisory explicitly states that "Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime." The operational security measures employed—including unique Telegram bot IDs per victim—and the tailored social engineering approaches are consistent with state-directed intelligence operations rather than opportunistic cybercrime. The linkage between digital surveillance and documented physical threat operations by Iranian intelligence services suggests coordination across Iran's security apparatus. This attribution comes amid broader Western concerns about Iranian state-sponsored cyber activities and transnational repression campaigns.

Business Impacty pro region

The geographic scope of CHOSEN BRICK targeting—spanning the UK, US, and Netherlands—demonstrates Iran's willingness to conduct surveillance operations within NATO member states and close Western allies, raising sovereignty and human rights concerns. For European nations hosting significant Iranian diaspora populations, the campaign highlights vulnerabilities among at-risk communities that may lack robust cybersecurity protections. The tri-lateral advisory reflects growing transatlantic coordination on countering Iranian cyber threats, potentially signaling expanded intelligence sharing and joint defensive measures. The disclosure may prompt additional European states to reassess Iranian cyber capabilities and consider diplomatic or sanctions responses. For civil society organizations supporting Iranian dissidents, the advisory underscores the need for enhanced digital security measures and awareness of state-sponsored surveillance risks. The campaign's success in compromising targets across multiple Western jurisdictions may embolden similar transnational repression efforts by other authoritarian states.

Forecast

If Iranian state actors continue to perceive dissidents and activists as strategic threats, similar surveillance campaigns leveraging social engineering and commodity platforms are likely to persist. Should Western governments impose additional sanctions or diplomatic consequences in response to this activity, Iran may adjust operational security measures or shift to alternative command-and-control infrastructure, though the fundamental targeting of perceived regime opponents is unlikely to cease. If victim data continues to appear on pro-Iranian leak sites, the risk of physical harm to compromised individuals may increase, potentially prompting host governments to enhance protective measures for at-risk populations. Should the tri-lateral advisory lead to improved detection capabilities and victim notification protocols, Iranian actors may invest in more sophisticated evasion techniques or explore mobile platform targeting beyond the currently observed Windows focus. If diaspora communities adopt recommended mitigations and heightened security awareness, the operational success rate of social engineering approaches may decline, potentially forcing Iranian actors to develop new initial access methods.