[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fx3z8qTYeISTeYv3waNqAG1GDOH0kpqTifMgrkgMoWok":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":26,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":60},"33f7131d-1d85-48c9-bdf0-b00c3c67e963","iranian-chosen-brick-malware-targets-dissidents-via-social-engineering","9eab7f84-0cbf-487c-879f-c97f1e2f7461","Iranian CHOSEN BRICK Malware Targets Dissidents via Social Engineering","Iranian state-linked threat actors are leveraging social engineering tactics to trick high-risk individuals — including activists, journalists, and dissidents — into voluntarily installing the CHOSEN BRICK malware on their Windows devices. Once installed, the malware exfiltrates sensitive communications, captures screenshots, records audio, and can even wipe systems entirely, leaving victims with no recourse. The use of Telegram bots and cloud services for command-and-control makes detection significantly harder for traditional security tools. This campaign underscores that technical vulnerabilities are not always the entry point — human trust and lack of awareness remain among the most exploited attack surfaces. Protecting high-risk populations requires both technical controls and robust security education tailored to their threat environment.","**Immediate actions:**\n- Train high-risk users (journalists, activists, NGO workers) to recognize and report social engineering attempts, including unsolicited software installation requests.\n- Enforce application allowlisting on endpoints to block unauthorized executables from running, regardless of how they are delivered.\n- Enable endpoint detection and response (EDR) solutions to detect anomalous behaviors such as unauthorized screenshot capture, audio recording, or mass file deletion.\n\n**Long-term improvements:**\n- Establish a formal digital security program for at-risk individuals that includes regular threat briefings, secure communications tools, and device hardening guides.\n- Implement Data Loss Prevention (DLP) controls to monitor and block unauthorized exfiltration of sensitive data to cloud services or unrecognized external destinations.\n- Adopt a zero-trust architecture that requires continuous verification before granting access to sensitive communications or data systems.\n\n**Detection measures:**\n- Monitor outbound network traffic for unusual connections to Telegram APIs or unknown cloud storage endpoints that may indicate command-and-control activity.\n- Configure SIEM alerts for suspicious process behaviors such as audio capture, bulk screenshot generation, or sudden large-scale file deletion events.\n- Conduct regular threat hunting exercises focused on indicators of compromise (IoCs) associated with known Iranian state-sponsored threat groups.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25],"CIS Control 3: Data Protection","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 IR-4: Incident Handling","NIST SP 800-53 AU-6: Audit Record Review","GDPR Article 32: Security of Processing","MITRE ATT&CK T1566: Phishing (Initial Access)","MITRE ATT&CK T1113: Screen Capture","MITRE ATT&CK T1123: Audio Capture","MITRE ATT&CK T1485: Data Destruction",{},"published","2026-09-16T22:20:39.023892+00:00","2026-09-16T22:20:38.911+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Firanian-hackers-use-chosen-brick-windows-malware-to-spy-on-targets\u002F","iranian-hackers-use-chosen-brick-windows-malware-to-spy-on-targets-768c30","Iranian hackers use CHOSEN BRICK Windows malware to spy on targets",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":42,"name":43,"slug":44,"description":45,"color":46},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":48,"name":49,"slug":50,"description":51,"color":52},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[54],{"id":55,"date":56,"edition":57,"title":58,"audio_url":59},"013c6944-8435-44e5-bfd0-1f59a4ef13de","2026-09-17","morning","ThreatNoir Morning Brief — September 17","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-17\u002Fthreatnoir-morning-brief-2026-09-17.mp3",[61,65,69],{"slug":62,"name":63,"problem":64},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":66,"name":67,"problem":68},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":70,"name":71,"problem":72},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]