Three Western intelligence agencies put a name to an Iranian spying operation on September 15, 2026, and the details read like a masterclass in patience over sophistication. The UK’s National Cyber Security Centre (NCSC), the FBI, and the Netherlands’ AIVD jointly disclosed a Windows spyware family the NCSC calls CHOSEN BRICK and the FBI calls HEAVYGRAM, used by Iranian state actors to spy on dissidents, activists, and journalists in the UK, US, and Netherlands, and around the world. The NCSC’s own September 2026 assessment states the spyware has been active since 2025 against targets spanning the globe, while the FBI traces the wider campaign back to autumn 2023, with documented victim activity dating to at least 2025, according to reporting from The Hacker News and Help Net Security. What makes the case notable isn’t a novel exploit or a zero-day. It’s a slow, human-driven con that rebuilds trust over days before ever sending a malicious file.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What the NCSC, FBI and AIVD Disclosed on September 15
The joint advisory, published as version 1 on September 15, 2026, attributes CHOSEN BRICK / HEAVYGRAM to Iran’s Ministry of Intelligence and Security (MOIS), the country’s primary intelligence service, per TechNadu’s summary of the release. It’s a rare instance of three national cyber agencies co-signing a single malware profile, which signals how seriously London, Washington, and The Hague are treating the threat to people living in their jurisdictions rather than just government networks. According to The Hacker News, the FBI had already flagged elements of the same campaign in a March 2026 alert, meaning September’s release functions as an escalation and consolidation of findings rather than a first warning.
Al Jazeera, summarizing the Western intelligence assessment, reported that agencies believe Iran is “almost certainly” using these cyber operations to target Iranian critics living in the West. That single phrase carries weight: agencies rarely commit language that strong to a public advisory unless the evidentiary bar has been cleared internally. The CHOSEN BRICK case follows a pattern security teams have tracked in other nation-state disclosures this year, including the CISA-flagged FudModule rootkit tied to North Korea’s Lazarus Group, where state actors likewise favored stealth and persistence over rapid exploitation.
Inside CHOSEN BRICK / HEAVYGRAM: What the Malware Actually Does
Once installed, CHOSEN BRICK turns a Windows PC into a full surveillance platform. Reuters’ September 2026 coverage distilled the theft down to three core data types: emails, messages, and other sensitive information, while the NCSC’s own advisory breaks the collection into three categories of its own, contacts, emails, and social-media messages. Per The Hacker News’ technical breakdown, the malware can copy emails and chat messages, take screenshots, switch on the device microphone to record audio, list running programs, and pull saved passwords and email addresses straight out of the browser. It also reaches into Telegram and WhatsApp’s local data stores, which is where most of the sensitive material tends to live for people who rely on those apps for organizing or reporting.
Later-stage capabilities go further than passive collection. The Hacker News reports that certain versions of the malware can download additional payloads, delete files, and in some builds wipe the machine entirely. That last capability shifts the tool from an espionage instrument into something closer to a sabotage weapon, and it lines up with a separate detail from Help Net Security’s coverage: the advisory notes potential ties between Iranian intelligence activity and more severe threats against perceived regime enemies abroad, including physical harm. CHOSEN BRICK runs on Windows only, according to both outlets, and The Register’s September 2026 reporting independently confirmed infections occurred exclusively on Windows systems, meaning the operation is squarely aimed at desktop and laptop users rather than mobile devices.
The WhatsApp and Telegram Playbook: How Targets Get Infected
The infection chain is built on rapport, not exploits. Operators open contact on WhatsApp or Telegram posing as someone the target already knows or as platform tech support, then spend days building a believable relationship before sending anything, according to The Hacker News and Help Net Security’s parallel reporting. Only after that groundwork is laid does the operator deliver the implant, disguised as a file the target would plausibly want: Norton Antivirus, Adobe Flash Player, KeePass, Telegram itself, the AI video tool Pictory, the AI generator RunwayML, or even fake MRI scan results.
The install runs in two stages. A decoy interface opens and appears to function normally, masking the real payload installing in the background, per Help Net Security’s account of the lure files. That two-stage structure is deliberately unglamorous. It relies on a target’s trust in a familiar contact and a familiar-looking application icon rather than on tricking antivirus software with clever code. Security teams reviewing phishing training programs should treat this case as evidence that identity verification over messaging apps, not just email, now belongs in standard awareness training.
Built to Hide: Persistence, Defender Evasion and Telegram-Based Control
CHOSEN BRICK survives reboots through a registry Run key, planting entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run using names like SMQDService or winappx to blend in with legitimate startup processes, according to The Hacker News’ indicator list. Help Net Security separately reports that the malware adds exclusions to Microsoft Defender, carving out a blind spot in the very tool many targets rely on for baseline protection.
Command and control runs through Telegram, with each infected machine assigned its own bot so operators can issue commands and pull data without standing up dedicated infrastructure that researchers could easily flag. Newer variants add proxy tunneling, and data exfiltration routes through both Telegram and commercial cloud storage, specifically Vultr’s object storage and Storj’s decentralized storage network, per domains identified in The Hacker News’ indicators of compromise (vultrobjects.com and storjshare.io). Using mainstream cloud services as a dead drop is a well-worn tactic because traffic to those domains looks routine next to traffic to a purpose-built command server, making it harder for network defenders to isolate the malicious flows from ordinary SaaS usage.
Who Is Being Targeted: Dissidents, Journalists and Activists
The advisory’s victim profile is consistent across every outlet that has reviewed it: dissidents, activists, and journalists who oppose the Iranian government, along with members of diaspora communities whose views conflict with Tehran, as described by Cyber-Defence.io’s analysis of the release. The NCSC itself named the UK, US, and Netherlands as confirmed victim countries in its September 2026 disclosure, with the advisory stating the campaign reaches targets globally.
This targeting profile sits apart from most state-linked malware disclosures, which typically center on government agencies, defense contractors, or critical infrastructure. CHOSEN BRICK instead goes after private individuals with no institutional security team, no dedicated IT department, and often no budget for endpoint protection. That gap is exactly why three national agencies chose to publish jointly and publicly rather than route findings through classified channels alone. A government employee has an incident response desk to call. A freelance journalist covering Iran from London does not.
Attribution: Iran’s Ministry of Intelligence and Security
The FBI attributes CHOSEN BRICK / HEAVYGRAM to MOIS, Iran’s principal civilian intelligence agency, distinguishing it from campaigns run by Iran’s separate military-linked cyber units. That attribution matters for how targets and researchers should think about the threat. MOIS-linked operations have historically prioritized long-running human intelligence collection over the smash-and-grab data theft associated with financially motivated crews, and the multi-day rapport-building approach documented in this advisory fits that pattern closely.
Per Al Jazeera’s reporting on the FBI’s framing, MOIS uses tools like CHOSEN BRICK not only to passively collect intelligence but to conduct data leaks and inflict reputational harm on targets, an active-measures use case that goes beyond traditional espionage. That framing echoes concerns raised in other 2026 nation-state advisories tracked on this site, including Microsoft Defender bypass techniques documented earlier this year, where evading endpoint detection was treated as a prerequisite for longer-term operations rather than a one-off trick.
CHOSEN BRICK / HEAVYGRAM at a Glance
| Attribute | Detail |
|---|---|
| NCSC designation | CHOSEN BRICK |
| FBI designation | HEAVYGRAM |
| Attributed to | Iran’s Ministry of Intelligence and Security (MOIS) |
| Campaign start | Autumn 2023 |
| Documented victim activity | Since at least 2025 |
| Confirmed victim countries | UK, US, Netherlands, plus global targeting claimed |
| Platform | Windows only |
| Delivery channel | WhatsApp and Telegram spear-phishing |
| Common lure files | Norton Antivirus, Adobe Flash Player, KeePass, Telegram, Pictory, RunwayML, fake MRI results |
| Persistence mechanism | Registry Run key (SMQDService / winappx) |
| Command and control | Per-device Telegram bot, plus proxy tunneling in newer builds |
| Exfiltration paths | Telegram, Vultr object storage, Storj storage network |
| Joint advisory issued by | UK NCSC, US FBI, Netherlands AIVD |
| Advisory publication date | September 15, 2026 |
Not Iran’s First Spyware: DCHSpy, BouldSpy, Domestic Kitten and Infy
CHOSEN BRICK is the newest entry in a spyware portfolio that Iranian state and state-linked actors have built over close to a decade, and the pattern of naming and re-naming individual tools across agencies is itself a running theme. On the mobile side, Lookout researchers identified DCHSpy, an Android surveillance tool developed and maintained by MuddyWater, an APT group also tracked as TA450, Seedworm, and Mango Sandstorm, and believed to be affiliated with MOIS. DCHSpy masquerades as VPN apps, including fake versions of Earth VPN, Comodo VPN, Hide VPN, and even a spoofed Starlink VPN, and once installed it silently pulls WhatsApp data, contacts, SMS messages, call logs, photos, location data, and audio.
Lookout’s broader tracking, cited by Infosecurity Magazine, has identified 17 mobile malware families used by at least 10 Iranian APTs against phone users, which puts CHOSEN BRICK’s Windows-only focus in context: it fills a gap in a toolkit that has otherwise leaned heavily on mobile. A separate UK Home Office country information note, also citing Lookout research, describes BouldSpy, an Android tool attributed with moderate confidence to FARAJA, Iran’s Law Enforcement Command, tracked since March 2020 and typically installed via physical access to a device, often obtained during detention, to monitor targets after their release.
The BBC has separately reported on two older operations, Domestic Kitten (also tracked as APT-50) and Infy (also known as Prince of Persia), which together have targeted more than 1,000 dissidents. Domestic Kitten distributed spyware through repackaged video games and apps mimicking a Tehran restaurant on Google Play, while Infy deployed spyware to home and work PCs in 12 countries via malicious email attachments, per the BBC’s reporting.
Comparing Iran’s State Spyware Arsenal
| Tool | Linked actor | Platform | Primary delivery method | Source |
|---|---|---|---|---|
| CHOSEN BRICK / HEAVYGRAM | MOIS | Windows | WhatsApp/Telegram rapport-building, disguised installers | NCSC, FBI, AIVD advisory |
| DCHSpy | MuddyWater (MOIS-affiliated) | Android | Fake VPN apps (Earth VPN, Comodo, Hide VPN, spoofed Starlink) | Lookout, via Infosecurity Magazine |
| BouldSpy | FARAJA (moderate confidence) | Android | Physical device access, often post-detention | UK Home Office note, citing Lookout |
| Domestic Kitten (APT-50) | Iran-linked (unspecified agency) | Android | Repackaged Google Play games and apps | BBC |
| Infy (Prince of Persia) | Iran-linked (unspecified agency) | Windows | Malicious email attachments | BBC |
A Decade of Iranian Digital Surveillance: Historical Context
Iran’s investment in surveillance capability isn’t limited to malware. An investigation by Forbidden Stories and its reporting partners found that Iranian authorities secretly purchased FindFace, a Russian facial recognition system, in 2019, confirmed through contracts obtained by the consortium. FindFace can identify faces in public spaces within seconds and cross-reference them against databases maintained by the regime’s security services, giving authorities a way to track protesters and journalists physically as well as digitally.
Read together, the FindFace acquisition, the BouldSpy detention-linked targeting, and now the CHOSEN BRICK advisory sketch a layered approach: identify people at protests or on watch lists, gain physical access to their phones when detained, and maintain longer-term digital access once they are back online or living abroad. Iran International, citing a Bloomberg investigation, has also reported that more than a dozen Iranians, including dissidents, were targeted with advanced spyware ahead of the war with Israel, including two dissidents inside Iran and a Europe-based Iranian tech expert, in an incident researchers say they have not fully explained. The Miaan Group’s 2025 threat intelligence report likewise documented targeted spyware attacks against Iranian users during what it called a wartime cyber crackdown, pointing to a mix of state-linked and mercenary tooling.
Market Impact: What This Means for Security Vendors and Enterprises
Joint advisories like this one tend to move faster through enterprise security stacks than typical threat reports because they arrive with government-verified indicators of compromise that vendors can turn into detection signatures within days. Expect endpoint detection and response vendors to push signature updates targeting the SMQDService and winappx registry entries, along with network rules flagging unusual traffic to vultrobjects.com and storjshare.io from consumer or non-sanctioned business accounts, the same category of indicator-driven response seen after the Citrix NetScaler bug landed on CISA’s Known Exploited Vulnerabilities list.
The Defender-exclusion evasion technique documented in this campaign also adds pressure on Microsoft and competing EDR vendors to lock down how easily local exclusions can be added without administrative alerting, a gap that has shown up in other 2026 disclosures, including the September Patch Tuesday round of zero-day fixes. For newsrooms, NGOs, and advocacy groups working with at-risk sources, the advisory functions as a procurement signal: expect renewed demand for managed threat detection services aimed specifically at civil society organizations, a market segment that has historically been priced out of enterprise-grade security tooling, and one that overlaps with the wider 2026 threat landscape of state-linked intrusions this site has tracked all year, including reporting on nation-state abuse of AI tooling and the ransomware economics detailed in our true cost of ransomware downtime analysis.
What Journalists, Activists and IT Teams Should Do Now
Because the infection chain depends on trust built over messaging apps rather than a technical exploit, the most effective mitigation is behavioral. Treat unexpected file-sharing requests on WhatsApp or Telegram as suspicious even when they appear to come from a known contact, and verify identity through a separate channel before opening any attachment, especially installers for antivirus tools, PDF or media utilities, or AI apps like Pictory and RunwayML.
On the technical side, IT teams supporting at-risk individuals should audit Microsoft Defender exclusion lists for entries the user did not knowingly add, check the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry path for unfamiliar SMQDService or winappx entries, and monitor outbound connections to api.telegram.org paired with traffic to vultrobjects.com or storjshare.io, both flagged as indicators in the advisory. Organizations supporting journalists or dissidents should also consider device compartmentalization, keeping a separate, minimally provisioned machine for sensitive communications rather than relying on a single daily-use laptop.
What Comes Next: Five Predictions for Iran’s Cyber Operations
- Expect a mobile counterpart to CHOSEN BRICK within the next several months, given MOIS’s established pattern of pairing Windows tools with Android equivalents, as seen with DCHSpy and BouldSpy.
- Cloud storage abuse for exfiltration will likely expand beyond Vultr and Storj to additional mainstream providers as defenders block the domains already named in this advisory.
- More governments are likely to follow the UK-US-Netherlands model of joint public attribution, since it shifts pressure onto Tehran diplomatically while giving private-sector defenders usable indicators faster than classified-only sharing.
- Civil society and press-freedom organizations will push for subsidized or free endpoint protection programs aimed at journalists and dissidents, mirroring efforts already underway for election security.
- Attribution disputes are likely, with Iranian officials expected to deny state involvement, consistent with the pattern following earlier disclosures of Domestic Kitten, Infy, and BouldSpy.
These are forward-looking assessments based on the documented pattern of Iranian cyber operations rather than confirmed plans, and should be read as analysis, not as claims made by the NCSC, FBI, or AIVD.
Frequently Asked Questions
What is CHOSEN BRICK spyware?
CHOSEN BRICK, also called HEAVYGRAM by the FBI, is a Windows spyware family attributed to Iran’s Ministry of Intelligence and Security. It steals emails, chat messages, screenshots, and audio recordings from infected computers, according to the joint NCSC, FBI, and AIVD advisory published September 15, 2026.
Who is behind the CHOSEN BRICK campaign?
The FBI attributes the malware to MOIS, Iran’s principal civilian intelligence agency. The campaign is believed to have started in autumn 2023, with documented victim activity since at least 2025.
Who is CHOSEN BRICK targeting?
The advisory names dissidents, activists, and journalists who oppose the Iranian government, along with diaspora community members, as the primary targets, with confirmed victims in the UK, US, and Netherlands.
How does CHOSEN BRICK infect a device?
Operators build rapport with targets over WhatsApp or Telegram for days while posing as a known contact or tech support, then deliver the malware disguised as legitimate software such as Norton Antivirus, KeePass, Telegram, Adobe Flash Player, Pictory, or RunwayML.
Does CHOSEN BRICK affect Mac or mobile devices?
No. Both The Hacker News and Help Net Security report that CHOSEN BRICK / HEAVYGRAM is a Windows-only malware family. Iran has separate Android spyware tools, including DCHSpy and BouldSpy, documented by Lookout and the UK Home Office.
How can I tell if my computer is infected with CHOSEN BRICK?
Check the registry path HKCU\Software\Microsoft\Windows\CurrentVersion\Run for unfamiliar entries named SMQDService or winappx, review Microsoft Defender’s exclusion list for additions you did not make, and watch for outbound network traffic to vultrobjects.com or storjshare.io, all listed as indicators in the joint advisory.
Is this the first time Iran has been linked to spyware against dissidents?
No. Iran-linked actors have been tied to multiple prior surveillance tools, including DCHSpy and BouldSpy on Android, Domestic Kitten and Infy campaigns documented by the BBC, and the FindFace facial recognition system reported by Forbidden Stories.
What should journalists and activists do to protect themselves?
Verify the identity of anyone sending files over WhatsApp or Telegram through a separate channel, avoid installing software sent via chat even if it looks legitimate, and consider using a separate, minimally provisioned device for sensitive communications.
