Iranian hackers use CHOSEN BRICK Windows malware to spy on targets

{"heading":"The CHOSEN BRICK Malware: Features and Functionality","subheading":"Understanding the CHOSEN BRICK malware's capabilities and how it operates.","paragraph_1":"CHOSEN BRICK is a Windows malware strain that has been used by Iranian state-linked hackers to target dissidents, activists, and journalists worldwide. The malware features data theft and espionage capabilities that collect email, Telegram, and WhatsApp communications, take screenshots, and record audio.","paragraph_2":"The threat actor primarily targeted individuals in the U.S., U.K., and the Netherlands, whose cybersecurity agencies published a joint advisory with the FBI. The malware is often disguised as legitimate applications, such as Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, KeePass, and others.","paragraph_3":"The malware adds Microsoft Defender exclusions to evade detection and connects to a unique Telegram bot that matches the victim's ID and provides command-and-control (C2). Once launched, CHOSEN BRICK can perform the following actions: collect system information, enumerate running processes, capture screenshots, record audio through the microphone, steal email content, steal Telegram or WhatsApp browser data, download additional payloads to 'C:\Windows \SysWOW64', delete files, and wipe the entire host system.","paragraph_4":"The stolen data is exfiltrated through Telegram or cloud services like VultrObjects and StorjShare, while newer CHOSEN BRICK variants route traffic through SOCKS5 proxies to conceal the activity. The advisory notes that the stolen data sometimes ends up on pro-Iranian leak sites, serving as a form of harassment and increasing the physical risk for dissidents abroad.","paragraph_5":"The advisory notes that the Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals internationally, who they perceive as enemies of the regime. Potential victims and organizations should inspect Registry Run entries for suspicious entries, search logs for indicators of compromise (IoCs) shared in the advisory, and investigate unexpected connections to Telegram's API, Backblaze B2, VultrObjects, StorjShare, IPRoyal, and LightningProxies as suspicious.","paragraph_6":"The advisory notes that the stolen data sometimes ends up on pro-Iranian leak sites, serving as a form of harassment and increasing the physical risk for dissidents abroad. The advisory notes that the Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals internationally, who they perceive as enemies of the regime. Potential victims and organizations should inspect Registry Run entries for suspicious entries, search logs for indicators of compromise (IoCs) shared in the advisory, and investigate unexpected connections to Telegram's API, Backblaze B2, VultrObjects, StorjShare, IPRoyal, and LightningProxies as suspicious."}