Chosen Brick, Iran’s Surveillance Malware
UK, US, and Dutch agencies expose Chosen Brick, Iranian malware used to track and harass dissidents, journalists, and activists via Telegram. The UK, the US, and the Netherlands published a joint advisory warning about a Windows malware family, dubbed Chosen Brick, that Iran’s intelligence services use to track down dissidents, journalists, and activists, and the […]
Pierluigi Paganini
September 17, 2026
The UK, the US, and the Netherlands published a joint advisory warning about a Windows malware family, dubbed Chosen Brick, that Iran’s intelligence services use to track down dissidents, journalists, and activists, and the stakes for the people on the receiving end go well beyond a locked file server.
Source: https://securityaffairs.com/199217/malware/chosen-brick-irans-surveillance-malware.html
Related breach coverage
- US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware2026-09-16
US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C. The post US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware appeared first on SecurityWeek.
- UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists2026-09-15
UK and allies provide advice to help organisations and individuals at risk detect and counter the threat from CHOSEN BRICK malware.
- Iranian cyber targeting of dissidents, activists and journalists2026-09-15
Advisory on CHOSEN BRICK malware, including technical analysis and advice to help individuals and organisations protect themselves.
- Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’2026-09-15
According to the United Kingdom’s National Cyber Security Centre (NCSC), Iran has used this and similar cyber activity to “support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists.”