Malware

CHOSEN BRICK

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.003Spearphishing via ServiceEvidence2

The actor often purports to be an individual previously known to the target or technical support from the social messaging platform (T1566.003).

Execution

1 technique

T1204.002Malicious FileEvidence1

The actor uses this rapport with the target to convince them to download and open a file that appears authentic to the target (T1204.002).

Persistence

2 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

The advisory warns CHOSEN BRICK is persistent and will survive a reboot of the target device.

T1547.001Registry Run Keys / Startup FolderEvidence1

CHOSEN BRICK is persistent and will survive a reboot of the target device. To do this it uses registry keys (T1547.001), most often the Run key in HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Privilege Escalation

2 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

The advisory warns CHOSEN BRICK is persistent and will survive a reboot of the target device.

T1547.001Registry Run Keys / Startup FolderEvidence1

CHOSEN BRICK is persistent and will survive a reboot of the target device. To do this it uses registry keys (T1547.001), most often the Run key in HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Stealth

2 techniques

T1036MasqueradingEvidence1

Iranian state actors have been observed impersonating contacts over messaging apps such as WhatsApp and Telegram.

T1480.002Mutual ExclusionEvidence1

CHOSEN BRICK malware registers mutexes, most commonly “ytyjyujyu” or “noi672pp434awkc12f”.

Discovery

2 techniques

T1057Process DiscoveryEvidence1

Enumerating running processes (T1057) and system information (T1082).

T1082System Information DiscoveryEvidence1

Enumerating running processes (T1057) and system information (T1082).

Collection

5 techniques

T1005Data from Local SystemEvidence1

Capture a copy of Telegram and WhatsApp data from web browsers (T1005).

T1113Screen CaptureEvidence2

Capturing screen content (T1113).

T1114.001Local Email CollectionEvidence1

Steal email content (T1114.001).

T1123Audio CaptureEvidence2

Enabling the microphone to capture audio content (T1123).

T1213Data from Information RepositoriesEvidence1

CHOSEN BRICK allows attackers to collect information on a target’s contacts, emails and social media messages.

Command and Control

3 techniques

T1090.002External ProxyEvidence1

Recent variations in this malware family include the use of HTTPS/SOCKS5 proxies to obscure the use of Telegram bots (T1090.002).

T1102.002Bidirectional CommunicationEvidence1

Once established on the victim, the malware connects to Telegram for Command and Control (T1102.002). Each victim device connects to a different Telegram Bot ID unique to them.

T1105Ingress Tool TransferEvidence1

It has been observed downloading additional malware... If the malware is instructed by the cyber actor to download additional malware it is written to disk in a configurable location.

Exfiltration

3 techniques

T1041Exfiltration Over C2 ChannelEvidence1

Files and collected data are exfiltrated through a combination of the Telegram bot (T1041).

T1567Exfiltration Over Web ServiceEvidence1

Personal details of some previous victims have appeared on pro-Iranian leak sites.

T1567.002Exfiltration to Cloud StorageEvidence1

Files and collected data are exfiltrated... through the use of cloud object stores such as VultrObjects and StorjShare (T1567.002).

Impact

1 technique

T1485Data DestructionEvidence1

Delete files (T1485)... Wipe the computer system (T1485).

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

the record mediaNews

Sep 15, 2026

Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’ | The Record from Recorded Future News

Windows spyware used in Iranian state-linked targeting of dissidents, activists, and journalists. It steals contacts, email, social-media messages, screenshots, and files; can activate the microphone; persists by relaunching at login; adds Microsoft Defender exclusions; and uses victim-specific Telegram bots, proxies, and cloud-storage services for command-and-control and exfiltration.

ncsc newsNews

Sep 15, 2026

Iranian cyber targeting of dissidents, activists and journalists | National Cyber Security Centre

Windows-focused Iranian state-linked spyware/backdoor delivered through tailored social engineering. It persists via Registry Run keys, evades Microsoft Defender by adding exclusions, uses victim-unique Telegram bots for command and control, and can collect system, process, screen, microphone, email, Telegram, and WhatsApp data; download additional payloads; delete files; and wipe systems. Data is exfiltrated via Telegram and cloud object stores.

ncsc newsNews

Sep 15, 2026

UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists | National Cyber Security Centre

Windows-exclusive persistent spyware used in Iranian state-linked spear-phishing campaigns. It collects contacts, emails, social-media messages and messaging history, captures screen content, accesses the device microphone, and can support tracking of victims' movements. It survives device reboots.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

CHOSEN BRICK

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.003Spearphishing via ServiceEvidence2

The actor often purports to be an individual previously known to the target or technical support from the social messaging platform (T1566.003).

Execution

1 technique

T1204.002Malicious FileEvidence1

The actor uses this rapport with the target to convince them to download and open a file that appears authentic to the target (T1204.002).

Persistence

2 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

The advisory warns CHOSEN BRICK is persistent and will survive a reboot of the target device.

T1547.001Registry Run Keys / Startup FolderEvidence1

CHOSEN BRICK is persistent and will survive a reboot of the target device. To do this it uses registry keys (T1547.001), most often the Run key in HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Privilege Escalation

2 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

The advisory warns CHOSEN BRICK is persistent and will survive a reboot of the target device.

T1547.001Registry Run Keys / Startup FolderEvidence1

CHOSEN BRICK is persistent and will survive a reboot of the target device. To do this it uses registry keys (T1547.001), most often the Run key in HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Stealth

2 techniques

T1036MasqueradingEvidence1

Iranian state actors have been observed impersonating contacts over messaging apps such as WhatsApp and Telegram.

T1480.002Mutual ExclusionEvidence1

CHOSEN BRICK malware registers mutexes, most commonly “ytyjyujyu” or “noi672pp434awkc12f”.

Discovery

2 techniques

T1057Process DiscoveryEvidence1

Enumerating running processes (T1057) and system information (T1082).

T1082System Information DiscoveryEvidence1

Enumerating running processes (T1057) and system information (T1082).

Collection

5 techniques

T1005Data from Local SystemEvidence1

Capture a copy of Telegram and WhatsApp data from web browsers (T1005).

T1113Screen CaptureEvidence2

Capturing screen content (T1113).

T1114.001Local Email CollectionEvidence1

Steal email content (T1114.001).

T1123Audio CaptureEvidence2

Enabling the microphone to capture audio content (T1123).

T1213Data from Information RepositoriesEvidence1

CHOSEN BRICK allows attackers to collect information on a target’s contacts, emails and social media messages.

Command and Control

3 techniques

T1090.002External ProxyEvidence1

Recent variations in this malware family include the use of HTTPS/SOCKS5 proxies to obscure the use of Telegram bots (T1090.002).

T1102.002Bidirectional CommunicationEvidence1

Once established on the victim, the malware connects to Telegram for Command and Control (T1102.002). Each victim device connects to a different Telegram Bot ID unique to them.

T1105Ingress Tool TransferEvidence1

It has been observed downloading additional malware... If the malware is instructed by the cyber actor to download additional malware it is written to disk in a configurable location.

Exfiltration

3 techniques

T1041Exfiltration Over C2 ChannelEvidence1

Files and collected data are exfiltrated through a combination of the Telegram bot (T1041).

T1567Exfiltration Over Web ServiceEvidence1

Personal details of some previous victims have appeared on pro-Iranian leak sites.

T1567.002Exfiltration to Cloud StorageEvidence1

Files and collected data are exfiltrated... through the use of cloud object stores such as VultrObjects and StorjShare (T1567.002).

Impact

1 technique

T1485Data DestructionEvidence1

Delete files (T1485)... Wipe the computer system (T1485).

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

the record mediaNews

Sep 15, 2026

Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’ | The Record from Recorded Future News

ncsc newsNews

Sep 15, 2026

Iranian cyber targeting of dissidents, activists and journalists | National Cyber Security Centre

ncsc newsNews

Sep 15, 2026

UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists | National Cyber Security Centre

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.