CTI · corroborated · 2026-09-17

Iranian state-linked CHOSEN BRICK malware targets dissidents worldwide

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1656 Impersonation Stealth
• T1547 Boot or Logon Autostart Execution Persistence
• T1562 Impair Defenses Stealth
• T1114 Email Collection Collection
• T1071 Application Layer Protocol Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: CHOSEN BRICK Iranian Spyware Registry Persistence
id: a3f7c2e1-8b4d-4e9a-b6c5-d12345678901
status: experimental
description: Detects CHOSEN BRICK Iranian state-linked spyware persistence via Windows Registry Run keys. The malware uses values SMQDService or winappx to survive reboots.
references:
  - https://www.bleepingcomputer.com/news/security/iranian-hackers-use-chosen-brick-windows-malware-to-spy-on-targets/
  - https://threat-intelligence.redeyesecurity.com/blog/iran-mois-heavygram-chosen-brick-telegram-malware-2026
author: Tia N. List
date: 2026/09/17
tags:
  - attack.t1547
  - attack.persistence
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains:
      - '\Run\SMQDService'
      - '\Run\winappx'
  condition: selection
falsepositives:
  - Unknown
level: high

References

• https://www.bleepingcomputer.com/news/security/iranian-hackers-use-chosen-brick-windows-malware-to-spy-on-targets/