Iran snoops on enemies of the state with Chosen Brick malware controlled using messaging apps

The UK National Cyber Security Centre, FBI, and Dutch AIVD have issued a joint security advisory warning that Iran is using the Chosen Brick malware against dissidents and journalists. This malware is capable of stealing files, capturing audio, grabbing data from messaging apps like WhatsApp and Telegram, and even wiping entire computer systems.

Iranian operatives rely on social engineering tactics to infiltrate their targets, often pretending to be someone known to the victim or posing as technical support for the messaging platform. They engage in extended conversations until the victim's guard is lowered, at which point they attempt to share the malware. This malware, primarily targeting Windows platforms, has capabilities ranging from enumerating running processes and system information, capturing screen content, and accessing microphone recordings, to downloading additional files and malware, deleting files, stealing email content, and ultimately wiping the entire computer system.

The three agencies emphasize that Iran likely uses cyber activity to repress individuals deemed threats to the regime, including dissidents, activists, and journalists. In some cases, they have even plotted to kidnap or carry out lethal operations against perceived enemies of the regime internationally. The best defense against this threat is increased awareness of social engineering tactics, along with technical mitigations such as keeping devices updated, using antivirus software, enabling phishing-resistant multi-factor authentication, and conducting regular endpoint and network monitoring.