Reported by 2 outlets
Iranian APT Uses CHOSENBRICK Windows Malware for Espionage
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Iranian hackers use # CHOSENBRICK # Windows # malware to spy on targets https://www. bleepingcomputer.com/news/secu rity/iranian-hackers-use
www.bleepingcomputer.com · 25d ago · September 18th, 2026
Iranian hackers use # CHOSENBRICK # Windows # malware to spy on targets https://www. bleepingcomputer.com/news/secu rity/iranian-hackers-use
via Mastodon https://www.bleepingcomputer.com/news/security/iranian-hackers-use-chosen-brick-windows-malware-to-spy-on-targets/
-
update from malware.news
Iranian Cyber Espionage Campaign
malware.news · 20d ago · September 23rd, 2026
The actor uses this rapport with the target to convince them to download and open a file that appears authentic to the target (T1204.002). These have been in the form of applications appearing to be legitimate applications. In other instances, they have been files appearing to be MRI scan results. This installs a trojan dubbed “CHOSEN BRICK” on the victim machine. The actor often initiates contact with the target’s work-related or corporate device in the first instance. If the initial delivery fails or the risk of detection is deemed significant, the actor will attempt to transition the delivery to personal devices. “CHOSEN BRICK” appears to target single devices as the malware doesn’t include any functionality for lateral movement. Assessment Iran conducts extensive cyber espionage on exiled Iranian nationals and dissidents abroad. This is primarily a threat to the individual privacy of those victims. The fact that this campaign primarily appears to target their victims’ corporate devices suggests that there might be a secondary motive to steal credentials to corporate networks, however. Threat actors that work for Iran’s Revolutionary Guard Corps (IRGC) are known to conduct cybercriminal attacks in a