Iran targets enemies with advanced malware

The UK National Cyber Security Centre, FBI, and Dutch intelligence warn that Iranian operatives are using Chosen Brick malware against dissidents, activists, and journalists deemed threats to the regime.

“Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime.”

Attackers pose as friends or tech support

Iranian operatives research targets extensively, then contact them via social media pretending to be someone they know or platform support staff. They build trust through extended conversations before delivering the malware.

Malware captures everything on your device

Chosen Brick can enumerate processes, capture screenshots and audio, steal WhatsApp and Telegram data, download additional malware, and delete or wipe entire systems. Operatives control it remotely via Telegram.

Thousand victims already infected

The malware has already compromised approximately one thousand victims. Iranian intelligence services have used cyber operations to support kidnapping and lethal operations against perceived enemies internationally.

Enable multi-factor authentication now

Agencies recommend using phishing-resistant multi-factor authentication, keeping devices updated with automatic patches, running antivirus software, and enabling email scanning and endpoint monitoring.

Stay alert to social engineering tactics

The best defense is awareness. Don't disable smart screen warnings, be skeptical of unexpected contacts, and monitor for indicators of compromise. Managed endpoint controls and network monitoring help detect infections early.