#Threat Intelligence — insecure by design

high1 source

Iranian State Hackers Steer Targets to Personal Hardware to Deploy Chosen Brick Spyware

State-sponsored Iranian cyber operators are increasingly sidestepping enterprise defenses by pushing targets to run malicious payloads on personal devices. A joint cybersecurity advisory released by the UK National Cyber Security Centre, the FBI, and the Dutch AIVD highlights the deployment of a custom Windows spyware family tracked as Chosen Brick. Attackers establish initial contact over messaging apps like WhatsApp and Telegram, often impersonating trusted contacts or technical support staff after extensive reconnaissance. When enterprise telemetry or delivery failures complicate deployment on a corporate workstation, operators instruct the individual to transfer and open the malicious file on a personal computer instead. Disguised payloads have included spoofed installers for utilities like KeePass, Telegram, Norton Antivirus, RunwayML, and fake MRI medical records. The initial droppers display convincing decoy interfaces while unpacking the main spyware payload in the background. Chosen Brick achieves persistence via standard Windows registry Run keys and actively configures folder exclusions within Microsoft Defender to evade endpoint detection. The malware features extensive surveillance capabilities, including harvesting contacts, emails, and social media messages, alongside live screen capture, microphone activation, and location tracking. Each compromised endpoint communicates through a dedicated Telegram bot to maintain distinct operational streams and prevent cross-contamination across victims. While the malware lacks automated lateral movement capabilities, it can retrieve secondary payloads from abused cloud storage services like Backblaze B2, Vultr, and Storj, with at least one observed variant containing disk-wiping functionality.

Covert Espionage and Intelligence Threats Leave German Industry in the Dark

A comprehensive study by German digital industry association Bitkom revealed that 96% of surveyed companies experienced or likely experienced data theft, industrial espionage, or sabotage over the past year. The research sampled more than 1,000 businesses generating at least one million euros in annual revenue and employing ten or more staff. Among definitively targeted firms, 37% linked at least one attack directly to foreign intelligence services, reflecting a climb from 28% the prior year. Attribution relied heavily on log file inspection, which served as the primary technical mechanism in 68% of incidents, alongside intelligence tips from government agencies for half of the identifying victims. Threat actors based in China and Russia were the most frequently identified, cited by 52% and 49% of affected firms respectively. Total estimated economic damages reached between 211 billion and 270.8 billion euros. Interestingly, definitive victim certainty fell by twenty percentage points while unprovable suspicions surged from 10% to 29%. This visibility gap stems largely from threat actors pivoting away from loud ransomware deployments toward stealthy espionage operations. Overall, 59% of respondents admitted that inadequate incident detection mechanisms contributed significantly to attacker success.

Agentic AI is Shifting the Economics and Tactics of Cyber Attacks

Recent discussions among enterprise security leaders highlight a transition toward goal-oriented AI agents capable of planning and executing multistep attacks with minimal human intervention. Unlike traditional deterministic security tools, these systems improvise workarounds to bypass enterprise controls, shifting the attack vector from stolen credentials to automated vulnerability discovery. Meanwhile, internal shadow AI adoption is proliferating rapidly without proper identity or access governance.