Iranian hackers spy on activists with the CHOSEN BRICK spyware

The intelligence services of several countries have issued a joint warning about a Windows malware called CHOSEN BRICK. According to the agencies, it is used by hackers linked to the Iranian state to surveil dissidents, activists and journalists. The main victims have been people in the US, the UK and the Netherlands — the cyber agencies of these countries prepared a joint bulletin together with the FBI.

How the attack works

Infection begins with social engineering: the victim is contacted over WhatsApp or Telegram by someone posing as a familiar contact or a tech-support employee. The person is then persuaded to open a malicious file disguised as a legitimate application — the lures on record include Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass. Often the victim is advised to run the file specifically on a personal device in order to bypass corporate defenses. In some cases even medical lures were used, such as a document containing MRI results.

The application displays a convincing interface that matches the cover story while quietly installing CHOSEN BRICK in the background and gaining persistence through autostart keys in the Windows registry. The program also adds exclusions to Microsoft Defender so as not to draw the antivirus's attention, and it connects to a personal Telegram bot tied to the identifier of a specific victim — that is the channel through which it is controlled.

What CHOSEN BRICK can do

Once launched, the malware gathers system information, enumerates running processes, takes screenshots, records audio from the microphone, and steals email contents along with Telegram and WhatsApp data from the browser. It is also able to download additional modules, delete files and wipe the system entirely.

Stolen data is exfiltrated through Telegram or cloud services such as VultrObjects and StorjShare, while more recent versions of CHOSEN BRICK disguise their traffic through SOCKS5 proxy servers.

Not just espionage

The bulletin notes a troubling detail: the stolen data sometimes ends up on pro-Iranian sites that publish leaks. This is a form of intimidation that raises the real, physical danger to dissidents who have emigrated. The agencies state plainly that Iran uses cyber operations to suppress those the regime considers a threat, and in a number of cases Iranian intelligence services have planned kidnappings or assassinations of people abroad.

Potential victims are advised to check the autostart entries in the registry, look through their logs for the indicators of compromise listed in the bulletin, and treat with suspicion any unexpected connections to the Telegram API, as well as to the Backblaze B2, VultrObjects, StorjShare, IPRoyal and LightningProxies services.

Source: Bleeping Computer