Build1 publisher2 min readPublished
CHOSEN BRICK routes its commands through a Telegram bot issued per victim device
A joint NCSC, FBI and AIVD advisory traces the implant's exfiltration to Telegram and three object storage hosts. The same advisory tells defenders not to read traffic to those services as malicious on its own.
The Engineer · Build desk
What happened
- The NCSC, FBI and AIVD published a joint advisory on 15 September 2026 on Iranian cyber targeting of dissidents, activists and journalists, describing Windows surveillance malware tracked as CHOSEN BRICK.
- Targets are talked into running a Windows file disguised as a legitimate application or as MRI results, and if that fails on a corporate device the operators may redirect the user to a personal one.
- The implant displays a fake screen while it sets up an HKCU Run key and adds a Microsoft Defender exclusion, so the victim sees an application and not a running infection.
- Commands arrive through a Telegram bot assigned specifically to that victim device, and the implant collects screens, audio, emails and browser messages.
- Newer variants push the Telegram bot traffic through HTTPS or SOCKS5 proxies, and the advisory also lists three object storage hosts as exfiltration destinations.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint The six domains only mean something when paired with process or file evidence, so a team with egress logs and no endpoint telemetry cannot conclude anything from a hit on the list.
- decision Hardening managed laptops moves this campaign rather than ending it, so any organisation supporting journalists has to decide whether it will also defend their personal machines.
- exposure Responders have to scope a confirmed infection for destruction as well as collection, because delete and wipe are in the command set.
- cost Blocking Telegram buys the end of live remote control and nothing else; whatever already left the device stays gone.
Each infected device gets its own Telegram bot [6]. That is tidy for the operator and unhelpful for a network sensor, because the destination is api.telegram.org for all of them, one of six domains the advisory lists as observation points [11]. Three of the six are object storage: backblazeb2.com, vultrobjects.com and storjshare.io. Two are commercial proxy providers, iproyal.com and lightningproxies.net [21]. The advisory attaches a condition to the whole list, telling defenders to correlate that traffic with evidence of executing processes or files and not to assume malicious intent from traffic to legitimate services [11].
Newer variants route the Telegram bot traffic through HTTPS or SOCKS5 proxies [9]. When that happens, the destination in the log is a proxy provider, and the capture no longer contains the string that named the C2.
The endpoint side is more tractable. The advisory names two HKCU Run key values to hunt, SMQDService and winappx, along with Microsoft Defender exclusions, non-standard paths, and processes associated with screen and audio capture [12]. The exclusion carries a qualifier: adding it is a defense evasion technique, and a successful exclusion is not treated as a mandatory prerequisite for all infections and data harvesting [13]. A rule that fires only on new exclusions will miss the hosts that never got one.
The path indicator wants care too. It is given as non-standard `C:\Windows \SysWOW64` paths [10], and as printed that string has a space in it. Anyone planning to match it literally should first work out whether the space is in the sample or in the typesetting.
Execution is the cheapest place to stop this. The stated prerequisite is that the target opens the fake file on a Windows device without malware execution being blocked [17], which the operator sets up by posing as a known contact or as technical support on WhatsApp or Telegram [3]. Where application control blocks the fake file or the follow-on malware, the advisory says that execution phase can be disrupted [15].
Scoping after a detection needs the same discipline as the hunt. Theft of email or browser message content alone does not establish that credentials or session tokens were stolen, according to the advisory [16]. The people being hit are dissidents, activists and journalists, with real-world compromises reported worldwide since at least 2025 [2], and public exposure of stolen information can lead to harassment or physical danger for them [19].
What to watch
- Publication of file hashes or per-device bot identifiers that would let defenders hunt without endpoint process telemetry.
- Whether proxy use spreads across enough variants that api.telegram.org stops appearing in captures at all.
- Confirmation that the same fake application was also delivered by email; the advisory only suggests checking for it.