Iranian hackers use CHOSEN BRICK Windows malware to spy on targets
-
Government agencies have issued a joint warning about an ongoing espionage campaign tied to Iranian state-linked hackers. The operation relies on a Windows malware strain tracked as CHOSEN BRICK, and its primary targets are dissidents, activists, and journalists around the world.
According to the advisory, the malware is designed for persistent surveillance rather than disruptive attacks, allowing operators to quietly monitor compromised systems over time. The campaign appears aimed at individuals whose work or public profile makes them valuable intelligence targets for the sponsoring state.
Key points from the warning:
- The threat actor is assessed to be linked to the Iranian government
- The malware family is identified as CHOSEN BRICK
- Targeting focuses on dissidents, activists, and journalists globally
- The campaign's purpose is espionage and long-term monitoring
No specific CVEs or exploitation details were included in the published warning, so defenders should focus on behavioral detection and standard hardening rather than signature-based indicators alone. Organizations and at-risk individuals should treat this as a reminder that surveillance-focused malware can remain undetected for extended periods, particularly when it avoids noisy or destructive actions.
Source: BleepingComputer
Does your organization have detection coverage for low-and-slow espionage tooling like CHOSEN BRICK?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login