#Chosen Brick

Iranian State Hackers Steer Targets to Personal Hardware to Deploy Chosen Brick Spyware

State-sponsored Iranian cyber operators are increasingly sidestepping enterprise defenses by pushing targets to run malicious payloads on personal devices. A joint cybersecurity advisory released by the UK National Cyber Security Centre, the FBI, and the Dutch AIVD highlights the deployment of a custom Windows spyware family tracked as Chosen Brick. Attackers establish initial contact over messaging apps like WhatsApp and Telegram, often impersonating trusted contacts or technical support staff after extensive reconnaissance. When enterprise telemetry or delivery failures complicate deployment on a corporate workstation, operators instruct the individual to transfer and open the malicious file on a personal computer instead. Disguised payloads have included spoofed installers for utilities like KeePass, Telegram, Norton Antivirus, RunwayML, and fake MRI medical records. The initial droppers display convincing decoy interfaces while unpacking the main spyware payload in the background. Chosen Brick achieves persistence via standard Windows registry Run keys and actively configures folder exclusions within Microsoft Defender to evade endpoint detection. The malware features extensive surveillance capabilities, including harvesting contacts, emails, and social media messages, alongside live screen capture, microphone activation, and location tracking. Each compromised endpoint communicates through a dedicated Telegram bot to maintain distinct operational streams and prevent cross-contamination across victims. While the malware lacks automated lateral movement capabilities, it can retrieve secondary payloads from abused cloud storage services like Backblaze B2, Vultr, and Storj, with at least one observed variant containing disk-wiping functionality.