logo

The MRI Scan That Wasn’t: Inside Iran’s ‘Chosen Brick’ Malware Campaign Against Its Critics Abroad

ID: 92562cbc-c42f-514a-8194-126f7448c272

STIX ID: report--92562cbc-c42f-514a-8194-126f7448c272

Feed Name: The Cyber Express

Threat Score
90/100

Date Published: 2026-09-16

Date Updated: 2026-09-17

Author: Mihir Bagwe

...
...

Joint advisories from the NCSC, FBI and Dutch intelligence describe CHOSEN BRICK/HEAVYGRAM, an Iranian state-run Windows spyware campaign that uses targeted social-engineering over WhatsApp/Telegram to deliver implants which persist, exfiltrate screenshots, audio, messaging sessions and mailboxes, and communicate via per-victim Telegram bots; some stolen data has appeared on pro-Iran leak sites, raising serious risks to dissidents' safety.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.