UK, US and Dutch agencies name CHOSEN BRICK as Iranian spyware aimed at dissidents

The durable artefacts are on the host. The implant relaunches at login so it survives a reboot ^[8], and it writes exclusions into Microsoft Defender to cut its chance of being caught ^[9]. Stolen files leave over Telegram and commercial cloud storage services ^[11], traffic most networks already permit. An unexplained Defender exclusion on a journalist's personal Windows laptop is the cheapest item on that list to check.

The decoy file matches whatever story the operator has told. Alongside the fake MRI scan, the operators have impersonated Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass ^[18]. Two of the six are security products, Norton Antivirus and KeePass ^[1].

The file arrives late in the conversation. Operators tailor the approach to each target, and the agencies say that produces wide variation in how a compromise begins ^[6]. The advisory describes the social engineering as extensive and does not say how long the rapport-building takes.

The NCSC did not identify a specific Iranian government entity behind the campaign ^[20]. In March the FBI did, in a flash warning that blamed actors operating "on behalf of the Government of Iran Ministry of Intelligence and Security", and the tradecraft in the new advisory closely matches that activity ^[21]. The bureau said similar Telegram-based malware has targeted Iranian dissidents and journalists since fall 2023 ^[22], about 15 months before the earliest victims the joint advisory covers ^[2]. It linked a July 2025 hack-and-leak operation to "Handala Hack", a persona it assesses is operated by MOIS and connected to a group called "Homeland Justice" ^[23]. Also in March, the State Department reissued a $10 million reward for information on hackers connected to Iranian cyber actors after the compromise of FBI director Kash Patel's personal email account ^[24], and the bureau seized several leak sites tied to MOIS that had hosted stolen material ^[25].

Iran has used this and similar cyber activity to "support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists", according to the NCSC ^[16]. The agencies say the harvested data builds a pattern of life, a map of a victim's location, contacts and daily routine ^[14]. Personal details taken this way have surfaced on pro-Iranian leak sites and been used to harass victims further ^[15]. The NCSC also said Iranian intelligence services have plotted to kidnap and assassinate individuals seen as enemies of the regime, including internationally ^[17].