AI-generated editorial illustration; not a documentary photograph.
Security agencies in the UK, US and Netherlands have warned that Iranian operatives are using malware known as Chosen Brick in campaigns targeting journalists, dissidents and activists. According to a joint advisory cited by TechRadar, the Windows-focused malware supports extensive surveillance, data theft and destructive actions.
Trust Built Before Infection
The reported attacks begin with research into a target and sustained social engineering rather than an immediate technical exploit. Operatives allegedly approach people through social media while posing as a known contact or platform support representative, maintain the conversation to establish trust, and then attempt to deliver the malware.
This approach makes people considered a threat by the Iranian government the central targets of the campaign. The advisory was issued jointly by the UK National Cyber Security Centre, the FBI and the Netherlands' General Intelligence and Security Service, known as AIVD.
Surveillance and Destruction
Chosen Brick can collect system information, enumerate running processes, capture screens and activate a computer's microphone, according to the agencies. It can also obtain copies of Telegram and WhatsApp browser data, steal email content, download additional files or malware, and delete files.
Its most destructive reported capability is wiping an entire computer. The operatives are also said to communicate with infected systems through Telegram, using a mainstream messaging service as part of the malware's control channel.
Defensive Measures
The agencies emphasize awareness of impersonation and other social-engineering tactics. Their technical recommendations include automatic software updates, antivirus protection, leaving Windows SmartScreen download warnings enabled, and adopting phishing-resistant multifactor authentication.
Organizations responsible for higher-risk users are also advised to manage devices with appropriate controls, scan email, monitor endpoints and networks, and search their environments for the indicators of compromise published with the advisory.
Source: Iran snoops on enemies of the state with Chosen Brick malware controlled using messaging apps
SIGNAL TITANS
Leave a Reply