[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9dXozRk-sx2B8eDZbTuX0tF_OKU7bCZPpdusReBZVgU":3},{"article":4,"iocs":48,"watch_terms":52,"solutions":53,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"9eab7f84-0cbf-487c-879f-c97f1e2f7461","Iranian hackers use CHOSEN BRICK Windows malware to spy on targets","iranian-hackers-use-chosen-brick-windows-malware-to-spy-on-targets-768c30","Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide. [...]","Iranian state-linked hackers are deploying a Windows malware called CHOSEN BRICK to target dissidents, activists, and journalists globally. The malware is capable of stealing communications, taking screenshots, recording audio, and can even wipe entire systems. Attackers use social engineering to trick victims into installing the malware, which then communicates via Telegram bots and exfiltrates data through cloud services or pro-Iranian leak sites.","Iranian hackers use CHOSEN BRICK malware to spy on dissidents, activists, and journalists.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Firanian-hackers-use-chosen-brick-windows-malware-to-spy-on-targets\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F04\u002F07\u002FIranian-hackers.jpg","2026-09-16T20:24:55+00:00","2026-09-16T22:00:34.132765+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Iranian state-linked hackers","threat_actor",{"name":21,"type":22},"Microsoft Defender","product",{"name":24,"type":25},"Windows Registry Run keys","technology",{"name":27,"type":25},"SOCKS5 proxies",{"name":29,"type":22},"Telegram","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":42,"value":50,"context":51},"CHOSEN BRICK","Name of the Windows malware strain used by Iranian hackers.",[21,29],{"controls":54,"vendors":139},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":85,"name":86,"problem":87,"products":88},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"slug":114,"name":115,"problem":116,"products":117},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[118,126,132],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":128,"url":130,"description":131},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":114,"product_name":136,"url":137,"description":138},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":159},"iranian-chosen-brick-malware-targets-dissidents-via-social-engineering","Iranian CHOSEN BRICK Malware Targets Dissidents via Social Engineering","Iranian state-linked threat actors are leveraging social engineering tactics to trick high-risk individuals — including activists, journalists, and dissidents — into voluntarily installing the CHOSEN BRICK malware on their Windows devices. Once installed, the malware exfiltrates sensitive communications, captures screenshots, records audio, and can even wipe systems entirely, leaving victims with no recourse. The use of Telegram bots and cloud services for command-and-control makes detection significantly harder for traditional security tools. This campaign underscores that technical vulnerabilities are not always the entry point — human trust and lack of awareness remain among the most exploited attack surfaces. Protecting high-risk populations requires both technical controls and robust security education tailored to their threat environment.",[145,146,147,148,149,150,151,152,153,154,155,156,157,158],"CIS Control 3: Data Protection","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 IR-4: Incident Handling","NIST SP 800-53 AU-6: Audit Record Review","GDPR Article 32: Security of Processing","MITRE ATT&CK T1566: Phishing (Initial Access)","MITRE ATT&CK T1113: Screen Capture","MITRE ATT&CK T1123: Audio Capture","MITRE ATT&CK T1485: Data Destruction",{}]