[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXa-BeSTuvZIa5-p798wdU4vPVsTzJp0zYi95x3B1DLg":3},{"article":4,"iocs":50,"watch_terms":88,"solutions":89,"lesson":174},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"0ab8cdbf-6d80-474e-ac1f-e7bf7a41b7a6","US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware","us-uk-dutch-agencies-expose-iranian-chosen-brick-surveillance-malware-f6002a","US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C. The post US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware appeared first on SecurityWeek.","US, UK, and Dutch agencies have exposed 'Chosen Brick,' a Windows surveillance malware used by Iranian state actors since at least 2025 to target dissidents, activists, and journalists globally. The malware harvests sensitive data, including contacts, emails, and social media messages, and can exfiltrate information via Telegram and cloud services. Stolen data has been used for harassment and posted on pro-Iranian leak sites.","US, UK, and Dutch agencies warn of Iranian 'Chosen Brick' surveillance malware targeting dissidents.","https:\u002F\u002Fwww.securityweek.com\u002Fus-uk-dutch-agencies-expose-iranian-chosen-brick-surveillance-malware\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-09-16T12:00:14+00:00","2026-09-16T12:00:22.315627+00:00",9,[17,20,23,25],{"name":18,"type":19},"Iranian state cyber actors","threat_actor",{"name":21,"type":22},"Telegram","product",{"name":24,"type":22},"Microsoft Defender",{"name":26,"type":22},"WhatsApp","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":27,"icon":29,"name":30,"slug":31},null,"Nation-state","nation-state",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,54,58,61,64,67,70,73,76,79,82,85],{"type":44,"value":52,"context":53},"Chosen Brick","Name of the Iranian state-sponsored surveillance malware.",{"type":55,"value":56,"context":57},"mitre_attack","T1059.003","Execution of PowerShell scripts for malware execution.",{"type":55,"value":59,"context":60},"T1547.001","Registry Run Keys \u002F Startup Folder for persistence.",{"type":55,"value":62,"context":63},"T1071.001","Web Protocols for C2 communication (Telegram).",{"type":55,"value":65,"context":66},"T1041","Exfiltration Over C2 Channel (Telegram).",{"type":55,"value":68,"context":69},"T1113","Screen Capture.",{"type":55,"value":71,"context":72},"T1125","Video Capture (Implied by audio recording).",{"type":55,"value":74,"context":75},"T1115","Clipboard Data.",{"type":55,"value":77,"context":78},"T1056.001","Keylogging.",{"type":55,"value":80,"context":81},"T1020","Automated Exfiltration.",{"type":55,"value":83,"context":84},"T1070.004","File Deletion.",{"type":55,"value":86,"context":87},"T1053.005","Scheduled Task \u002F Job.",[21,24,26],{"controls":90,"vendors":173},[91,120,149],{"slug":92,"name":93,"problem":94,"products":95},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":121,"name":122,"problem":123,"products":124},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"slug":150,"name":151,"problem":152,"products":153},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[154,161,166],{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":150,"product_name":158,"url":159,"description":160},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":162,"product_name":163,"url":164,"description":165},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":167,"vendor_name":168,"vendor_logo":169,"product_slug":167,"product_name":170,"url":171,"description":172},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":175,"title":176,"body":177,"framework_refs":178,"framework_notes":191},"iranian-chosen-brick-malware-targets-dissidents-and-activists-worldwide","Iranian 'Chosen Brick' Malware Targets Dissidents and Activists Worldwide","Iranian state actors deployed 'Chosen Brick,' a Windows-based surveillance malware, to systematically harvest sensitive personal data — including contacts, emails, and social media messages — from dissidents, journalists, and activists. The stolen information was weaponized for harassment campaigns and published on pro-Iranian leak sites, demonstrating how surveillance malware can cause real-world physical and reputational harm beyond the digital realm. At-risk individuals, particularly those opposing authoritarian regimes, often lack the technical awareness to recognize sophisticated spyware infections on their devices. This case underscores that state-sponsored threat actors increasingly target civil society, not just government or corporate networks, making broad security awareness and device hygiene critical for vulnerable populations.",[179,180,181,182,183,184,185,186,187,188,189,190],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 13: Network Monitoring and Defense","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 SC-8: Transmission Confidentiality and Integrity","NIST SP 800-150: Guide to Cyber Threat Information Sharing","GDPR Article 32: Security of Processing (for EU-based individuals affected)","GDPR Article 33: Notification of a Personal Data Breach","ITIL: Information Security Management — Threat & Vulnerability Management",{}]