Iranian State Hackers Steer Targets to Personal Hardware to Deploy Chosen Brick Spyware
State-sponsored Iranian cyber operators are increasingly sidestepping enterprise defenses by pushing targets to run malicious payloads on personal devices. A joint cybersecurity advisory released by the UK National Cyber Security Centre, the FBI, and the Dutch AIVD highlights the deployment of a custom Windows spyware family tracked as Chosen Brick. Attackers establish initial contact over messaging apps like WhatsApp and Telegram, often impersonating trusted contacts or technical support staff after extensive reconnaissance. When enterprise telemetry or delivery failures complicate deployment on a corporate workstation, operators instruct the individual to transfer and open the malicious file on a personal computer instead. Disguised payloads have included spoofed installers for utilities like KeePass, Telegram, Norton Antivirus, RunwayML, and fake MRI medical records. The initial droppers display convincing decoy interfaces while unpacking the main spyware payload in the background. Chosen Brick achieves persistence via standard Windows registry Run keys and actively configures folder exclusions within Microsoft Defender to evade endpoint detection. The malware features extensive surveillance capabilities, including harvesting contacts, emails, and social media messages, alongside live screen capture, microphone activation, and location tracking. Each compromised endpoint communicates through a dedicated Telegram bot to maintain distinct operational streams and prevent cross-contamination across victims. While the malware lacks automated lateral movement capabilities, it can retrieve secondary payloads from abused cloud storage services like Backblaze B2, Vultr, and Storj, with at least one observed variant containing disk-wiping functionality.
Commentary
This advisory underscores an evolving tactical pivot where state actors explicitly acknowledge corporate endpoint detection and response (EDR) capabilities and adapt their social engineering accordingly. By convincing users to execute payloads on unmanaged, personal hardware, operators neatly bypass enterprise controls like application allowlisting, centralized logging, and strict perimeter firewalls. The real-world stakes here extend beyond typical credential harvesting. With Iranian intelligence operations historically tied to physical surveillance, harassment, and kinetic plots against dissidents, compromise of personal endpoints poses severe personal safety risks. A compromised microphone or screen capture feed on a personal laptop gives operators immediate insight into off-the-record communications and physical movement. From a defensive perspective, relying exclusively on corporate endpoint monitoring is no longer sufficient for high-risk personnel. Security teams supporting journalists, activists, or human rights researchers must extend threat modeling and operational security guidance to personal ecosystems. Defenders should monitor egress traffic for anomalous connections to legitimate cloud storage APIs (such as Backblaze B2, Storj, and Vultr Object Storage) and proxy networks like Lightning Proxies or IPRoyal, while enforcing phishing-resistant MFA across external identity providers.
The Quote to Remember
“Iranian threat actors typically make first contact through a target's work device. If that delivery fails or the risk of detection appears too high, the attacker asks the target to open the file on a personal machine instead”
“Once installed, the malware survives reboots by writing itself to a Windows registry run key and adds exclusions to Microsoft Defender to avoid detection.”