As reported by BleepingComputer, a joint advisory from the FBI, UK NCSC, and Dutch agencies details CHOSEN BRICK, a Windows espionage tool deployed by Iranian state-linked threat actors against dissidents, activists, and journalists primarily in the U.S., U.K., and Netherlands. What sets this campaign apart is not its technical sophistication but its operational design: it is purpose-built for individual surveillance, not enterprise compromise.

Threat Intelligence: As reported by BleepingComputer, a joint advisory from the FBI, UK NCSC, and Dutch agencies details CHOSEN BRICK, a Windows espionage tool deployed by Iranian state-linked threat actors against dissidents, activists, and journalists primarily in the U.S., U.K., and Netherlands.

Why This Campaign Is Different

Most nation-state malware we analyze targets networks, credentials, or data repositories inside organizations. CHOSEN BRICK inverts that model. The threat actor's objective is personal — monitoring private communications, recording audio, and collecting information that can be used for harassment, intimidation, or physical targeting. The advisory explicitly notes that stolen data has appeared on pro-Iranian leak sites, and that Iranian intelligence has plotted kidnappings and lethal operations against perceived enemies abroad. This is cyber-enabled repression with a kinetic edge.

The intersection of digital surveillance and physical danger makes this campaign categorically different from conventional espionage. Defenders protecting at-risk individuals must treat endpoint compromise as a potential life-safety event.

Abuse of Legitimate Infrastructure

The most notable tactical choice is the malware's reliance on Telegram bots for command-and-control. Each victim is assigned a unique bot token matching their ID, meaning traffic blends into the enormous volume of legitimate Telegram API calls. Exfiltration routes through VultrObjects and StorjShare — both legitimate cloud storage services — further reduce the likelihood of network-level detection. Newer variants add SOCKS5 proxying, making attribution and traffic analysis even harder.

This is a defender's nightmare: the infrastructure is not malicious, the domains are not flagged, and the traffic patterns look ordinary. Traditional IOC-based perimeter defenses will largely miss this. Detection must happen at the endpoint.

Social Engineering Precision

The initial access vector is carefully engineered. Attackers impersonate trusted contacts or technical support on WhatsApp and Telegram, then deliver trojanized applications — Pictory, RunwayML, KeePass, Norton Antivirus, even fake MRI scan viewers. The suggestion to run these on personal devices to bypass corporate security is a deliberate tactic to move targets into an unmanaged, unmonitored environment where no EDR exists.

This tells us the actor understands that journalists and activists often split work between managed and personal devices. The unmanaged personal laptop or phone is the soft target.

Persistence and Defense Evasion

CHOSEN BRICK establishes persistence via Windows Registry Run keys — a well-known but still effective technique — and adds Microsoft Defender exclusion paths to avoid signature-based detection. The malware can also wipe the entire host, functioning as an anti-forensics tool to destroy evidence after exfiltration is complete.

Shield53 Recommendations

For Organizations Protecting At-Risk Individuals

Shield53 Recommendations
Extend endpoint protection to personal devices. Provide managed EDR or at minimum Microsoft Defender for Endpoint to journalists, activists, and staff who may be targeted. Unmanaged personal devices are the primary attack surface.
Monitor Registry Run keys. Deploy detection rules for new or modified entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM equivalents. Flag any entry pointing to unexpected executable paths.
Alert on Defender exclusion additions. Any process that modifies Add-MpPreference -ExclusionPath or equivalent registry settings should trigger an immediate alert. This is a high-fidelity indicator of defense evasion.
Monitor for anomalous Telegram API traffic. While legitimate Telegram use is common, outbound connections to api.telegram.org from processes other than the official Telegram client warrant investigation. Correlate with process telemetry.
Hunt for VultrObjects and StorjShare upload activity. These are uncommon services for typical end-user traffic. Network egress to these domains from workstations — especially outside business hours — should be reviewed.
Conduct targeted security awareness training. Brief at-risk staff on impersonation tactics via messaging apps. Emphasize that no legitimate software vendor or support agent will ask users to install applications on personal devices to bypass corporate controls.
Implement application allow-listing on managed devices. Tools like WDAC or AppLocker prevent execution of untrusted binaries, neutralizing the trojanized-application delivery vector entirely.

For Individual Targets

  • Verify any software download through official vendor websites only — never through links shared on messaging platforms.
  • Treat any request to install software on a personal device as a red flag, regardless of who appears to be asking.
  • Enable real-time protection and avoid disabling Defender exclusions under any circumstance.
  • Use hardware-based security keys (FIDO2) for critical accounts to reduce the value of stolen credentials.

The CHOSEN BRICK campaign underscores a reality that security teams must internalize: when the adversary is a nation-state targeting individuals rather than networks, the threat model shifts from data loss to personal safety. The defensive posture must shift accordingly.