DigitalSpying Security Desk
September 16, 2026
Executive Summary
In a coordinated international intelligence advisory, cybersecurity authorities across three nations—the United States Federal Bureau of Investigation (FBI), the United Kingdom’s National Cyber Security Centre (NCSC), and the Netherlands’ General Intelligence and Security Service (AIVD)—have exposed a persistent state-sponsored spyware campaign. As reported by The Hacker News and The Record, the campaign is operated by Iran's Ministry of Intelligence and Security (MOIS) and utilizes a stealthy Windows surveillance implant designated CHOSEN BRICK by the UK NCSC and HEAVYGRAM by the FBI.
The operators utilize high-touch social engineering over WhatsApp and Telegram—deploying tailored lures such as fake medical MRI spinal scan results and artificial intelligence video tools—to infect personal and professional workstations. Once installed, the spyware is orchestrated entirely through dedicated Telegram Bot API instances, exfiltrating emails, private chats, screen captures, and live microphone audio recordings to construct "pattern-of-life" intelligence profiles used to facilitate state-backed harassment, physical tracking, and intimidation of Iranian dissidents, journalists, and activists worldwide.
Deep-Dive Technical Analysis
1. Initial Access & Precision Social Engineering
The MOIS threat cluster avoids mass spam in favor of highly targeted, relationship-based social engineering:
* Platform Convergence: Operators initiate contact with victims over end-to-end encrypted messaging platforms, predominantly WhatsApp and Telegram.
* Pretexting & Trust Building: Attackers masquerade as trusted professional contacts, independent journalists, medical professionals, or technical support representatives, maintaining dialogues over several days to build rapport.
* Deceptive File Lures: The malware is delivered via tailored file packages:
* Medical Lures: Executables disguised as high-resolution MRI scans of spinal disc herniations (e.g., sent under the guise of seeking medical consultations or sharing family health updates).
* Software & AI Lures: Installers masquerading as AI video generation suites (RunwayML, Pictory), KeePass password managers, or security software (Norton Antivirus).
2. CHOSEN BRICK / HEAVYGRAM Implant Architecture
The malware is a modular Windows implant engineered for sustained host surveillance and defense evasion:
* Persistence Mechanism: Establishes persistence via Windows Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to survive system reboots, executing automatically upon user logon.
* Antivirus Tampering: The implant actively manipulates Windows Defender by executing PowerShell commands to add path exclusions for its staging directories (Add-MpPreference -ExclusionPath ...), suppressing on-disk behavioral alerts.
* The Telegram Bot C2 Subsystem:
* Architecture: Unlike traditional malware that relies on fixed domain names or IP-based command-and-control servers, CHOSEN BRICK routes all communications through the official Telegram Bot API (api.telegram.org).
* Victim Isolation via Dedicated Bots: Each compromised host is assigned a unique Telegram bot token and dedicated chat channel. This architectural compartmentalization prevents security researchers from discovering or sinkholing all victims if a single bot token is identified.
* Proxy Layering: Recent builds route Telegram HTTPS requests through rotating SOCKS5 and HTTP proxies to bypass enterprise network egress inspection and geo-blocking.
Kill Chain Phase
Action Performed
Initial Delivery
High-touch social engineering via WhatsApp/Telegram delivering fake MRI or AI tool lures.
Infection
Victim executes file; CHOSEN BRICK implant drops onto Windows workstation.
Evasion
PowerShell executes to add Microsoft Defender path exclusions for staging directories.
Persistence
Registry Run keys established in HKCU to ensure execution upon logon.
Command & Control
Bi-directional communication via api.telegram.org using unique bot tokens.
Exfiltration
Surveillance data compressed and uploaded to Telegram or commercial cloud storage.
3. Surveillance Capabilities: Acoustic & Communication Harvesting
CHOSEN BRICK is designed to extract a complete digital and physical footprint of the victim:
* Microphone Eavesdropping: Silently interfaces with local audio recording drivers (via Windows Core Audio APIs), capturing ambient room audio and saving compressed .wav or .mp3 clips for upload.
* Desktop Screen Monitoring: Periodically captures desktop screenshots, tracking active application windows and keystrokes during private conversations.
* Communications Exfiltration: Automatically scans and exfiltrates local SQLite databases for desktop messaging clients (Telegram Desktop, WhatsApp for Windows) and exports Outlook (.pst/.ost) and Thunderbird email stores.
* Staging & Data Transfer: Stolen archives are compressed, password-protected, and transmitted via Telegram Bot file-upload endpoints or secondary commercial cloud storage providers such as Google Drive or Mega.
Industry Impact & The Physical Threat Dimension
* From Cyber Espionage to Physical Peril: Western intelligence agencies stress that the intelligence gathered by MOIS does not remain in cyberspace. Pattern-of-life dossiers—mapping victims' physical home addresses, daily routines, and family contacts—have been used by Iranian intelligence to coordinate physical surveillance, kidnap plots, and assassination operations against regime dissidents in North America and Europe.
* Targeting Personal Devices to Evade Enterprise Controls: Attackers deliberately lure targets off managed enterprise laptops onto personal, unmanaged home computers and smartphones, bypassing corporate endpoint detection and response (EDR) agents.
Actionable Recommendations & Defense Playbook
1. Identifying CHOSEN BRICK / HEAVYGRAM on Windows
Security teams and at-risk individuals should inspect systems for key indicators:
* Registry Run Keys: Review HKCU\Software\Microsoft\Windows\CurrentVersion\Run for File running from %APPDATA% or %LOCALAPPDATA%.
* Defender Exclusions Audit: Run PowerShell command Get-MpPreference | Select-Object -ExpandProperty ExclusionPath to inspect any unauthorized antivirus exclusions.
* Audit Telegram Bot Traffic: In enterprise networks, monitor proxy logs for anomalous, automated HTTP POST traffic to api.telegram.org/bot
2. High-Risk Personal Device Hardening
* Strict Separation of Identities: Dissidents, journalists, and activists must avoid opening unverified file attachments or media archives received over WhatsApp, Telegram, or Signal, even from seemingly familiar contacts.
* Employ Application Sandboxes: Open medical images and external documents exclusively within isolated environments (e.g., Windows Sandbox, dedicated disposable virtual machines, or air-gapped viewers).
* Physical Microphone Isolation: For high-risk environments, consider physical microphone disconnect switches or hardware privacy covers on portable workstations.
Sources and Reference Intelligence:
UK National Cyber Security Centre (NCSC), Federal Bureau of Investigation (FBI), The Hacker News, The Record.