Iranian CHOSEN BRICK Malware Targets Dissidents via Social Engineering
Written by AI from the linked story. Not reviewed by an editor. How this works
Iranian state-linked threat actors are leveraging social engineering tactics to trick high-risk individuals — including activists, journalists, and dissidents — into voluntarily installing the CHOSEN BRICK malware on their Windows devices. Once installed, the malware exfiltrates sensitive communications, captures screenshots, records audio, and can even wipe systems entirely, leaving victims with no recourse. The use of Telegram bots and cloud services for command-and-control makes detection significantly harder for traditional security tools. This campaign underscores that technical vulnerabilities are not always the entry point — human trust and lack of awareness remain among the most exploited attack surfaces. Protecting high-risk populations requires both technical controls and robust security education tailored to their threat environment.
Tactical Insight
Immediate actions
- Train high-risk users (journalists, activists, NGO workers) to recognize and report social engineering attempts, including unsolicited software installation requests.
- Enforce application allowlisting on endpoints to block unauthorized executables from running, regardless of how they are delivered.
- Enable endpoint detection and response (EDR) solutions to detect anomalous behaviors such as unauthorized screenshot capture, audio recording, or mass file deletion.
Long-term improvements
- Establish a formal digital security program for at-risk individuals that includes regular threat briefings, secure communications tools, and device hardening guides.
- Implement Data Loss Prevention (DLP) controls to monitor and block unauthorized exfiltration of sensitive data to cloud services or unrecognized external destinations.
- Adopt a zero-trust architecture that requires continuous verification before granting access to sensitive communications or data systems.
Detection measures
- Monitor outbound network traffic for unusual connections to Telegram APIs or unknown cloud storage endpoints that may indicate command-and-control activity.
- Configure SIEM alerts for suspicious process behaviors such as audio capture, bulk screenshot generation, or sudden large-scale file deletion events.
- Conduct regular threat hunting exercises focused on indicators of compromise (IoCs) associated with known Iranian state-sponsored threat groups.