CHOSEN BRICK linked to espionage targeting dissidents and journalists
SecurityUnverifiedUpdated:
A reported espionage operation uses the Windows malware CHOSEN BRICK against dissidents, activists, and journalists. The targets are described primarily as individuals in the US, UK, and the Netherlands.
Lures impersonating contacts and support staff
According to the report, attackers send WhatsApp or Telegram messages posing as trusted contacts or technical-support staff, then persuade recipients to open malicious files disguised as legitimate applications. The files reportedly install CHOSEN BRICK, a Windows malware strain that can collect email and Telegram or WhatsApp browser data, record microphone audio, retrieve additional payloads, and erase the affected system.
The reported operation begins with impersonation messages sent over WhatsApp or Telegram.
Government agencies now warn that Iranian state-linked hackers are using the Windows malware CHOSEN BRICK in espionage campaigns against these targets. The supplied report says the malware can steal communications, capture screenshots and audio, persist on a device, and wipe a host system.
Communications theft alongside host-wiping capability
The reported operation combines familiar impersonation lures with access to private communications and destructive host-wiping capability. The advisory also describes use of Telegram bots, cloud services, and proxies in the malware’s command-and-control and data-transfer activity.
Sources
- BleepingComputerIranian hackers use CHOSEN BRICK Windows malware to spy on targetsRead source →