Loading story…
The UK National Cyber Security Centre, FBI, and Netherlands AIVD have disclosed an Iranian state-linked campaign using CHOSEN BRICK Windows spyware against dissidents, activists, journalists, and other perceived opponents of the Iranian regime, including victims in the UK, United States, and Netherlands. Active since at least 2025, operators impersonate trusted contacts on WhatsApp and Telegram, cultivate relationships with targets, and deliver tailored malicious files masquerading as legitimate applications or documents; one reported lure used fabricated MRI scan results.
CHOSEN BRICK establishes reboot persistence, weakens Microsoft Defender protections, and uses victim-specific Telegram bots for command and control. It can collect screenshots, microphone audio, emails, files, browser-accessible WhatsApp and Telegram data, and system information, while exfiltrating data through Telegram and cloud object stores and deploying additional malware. The agencies warned that stolen information has appeared on pro-Iranian leak sites, enabling profiling and harassment and potentially increasing targets' physical-safety risks; they released indicators and mitigation guidance.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
The FBI issued a technical report on CHOSEN BRICK, accompanying the joint advisory and providing further analysis of the Iranian spyware.
The NCSC, FBI, and Netherlands AIVD issued a joint advisory attributing CHOSEN BRICK spyware activity to Iranian state cyber actors. The advisory detailed tailored WhatsApp and Telegram social engineering, Windows-focused surveillance malware, victim-specific Telegram command-and-control, and risks from stolen data being published on pro-Iranian leak sites.
MI5 Director-General Ken McCallum said British security services had tracked more than 20 potentially lethal Iran-backed plots during the preceding year, including threats against journalists and opponents of the Iranian government.
The FBI linked a July 2025 hack-and-leak operation to Handala Hack, which it assesses operates on behalf of Iran's Ministry of Intelligence and Security and is connected to Homeland Justice.
Iranian state cyber actors began targeting dissidents, activists, and journalists worldwide, including in the United Kingdom, United States, and Netherlands, using the CHOSEN BRICK malware family from at least 2025.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcencsc.gov.uk
Open sourcencsc.gov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026
The FBI warned that hackers linked to Iran’s Ministry of Intelligence and Security (MOIS) are using Telegram as command-and-control infrastructure in malware campaigns targeting Iranian dissidents, journalists, and opposition groups worldwide. The activity, observed since late 2023, relies on social engineering in which attackers impersonate trusted contacts or tech support and deliver malware disguised as legitimate apps such as Telegram, WhatsApp, or KeePass. Once installed on Windows systems, the multi-stage malware establishes persistence and connects to Telegram bots, allowing operators to steal files, capture screenshots and audio, record Zoom calls, compress data, and exfiltrate information. U.S. authorities said the operations appear tailored to victims’ behavior, suggesting prior reconnaissance, and tied the activity to broader MOIS influence and disruption efforts. The FBI said the same ecosystem includes the fake hacktivist brands **Handala Hack** and **Homeland Justice**, which it linked to hack-and-leak operations that combine APT-style intrusions with disinformation and selective data leaks to cause reputational and political harm. The Justice Department has separately described Handala as an MOIS front involved in the recent Stryker attack, while the FBI has seized websites associated with Handala and Homeland Justice.
Jun 29, 2026
The FBI warned that cyber actors working on behalf of Iran’s **Ministry of Intelligence and Security (MOIS)** used Telegram as command-and-control infrastructure in a long-running malware campaign targeting Iranian dissidents, anti-regime journalists, and other opposition figures around the world. In FLASH-20260320-001, the bureau said the activity has been ongoing since at least fall 2023 and relied on social engineering and victim-tailored lures to deliver multi-stage Windows malware disguised as legitimate applications including **Telegram**, **KeePass**, **WhatsApp**, and **Pictory**. According to the alert, the second-stage implant enabled persistent remote access and bidirectional communications through Telegram infrastructure, allowing operators to steal files, compressed archives, screen captures, and audio from infected systems. The FBI also linked some July 2025 hack-and-leak activity claimed by **Handala Hack** to malware used in the campaign and assessed that Handala Hack is connected to **Homeland Justice**, which it described as another MOIS-operated online entity, underscoring Iran’s broader use of proxy personas and cyber operations to combine espionage, data theft, and information operations.
Jun 29, 2026