CHOSEN BRICK is aimed at people, not at your ERP

The UK NCSC, the FBI, and the Dutch AIVD published a joint advisory on Iranian state cyber activity against dissidents, activists, and journalists. The Windows malware family is CHOSEN BRICK. It has been used since at least 2025 against people in the UK, the US, the Netherlands, and elsewhere. This is not a mass-scan story. It is a targeting story. If your firm, clinic, or advocacy shop works with those communities, it belongs on your list.

What the agencies said

Operators impersonate contacts on WhatsApp, Telegram, and Instagram, build rapport, then talk the target into running something. CHOSEN BRICK collects contacts, mail, and social messages. It can take screen content and reach the microphone. It persists across reboot. Stolen personal details have shown up on pro-Iranian leak sites, which raises a physical-safety problem, not only a privacy one. The agencies are explicit: Iran almost certainly uses this kind of activity to support repression of people it sees as a threat.

The FBI published a companion technical note on related Telegram command-and-control tooling (they track overlapping activity as HEAVYGRAM). Unique bot identifiers per victim reduce cross-contamination. Exfiltration rides Telegram and cloud storage. We are not going to reprint a cookbook. The official PDFs are the place for hashes and detections if you have a live case.

Why a Canadian shop should still read it

Canada has diaspora communities, journalists, and NGOs that fit the targeting pattern. Law firms and clinics that hold those clients' files are adjacent. A spear-phish that looks like a friend on Telegram is not something your Secure Email Gateway will see. The endpoint and the person's other phone are the control.

If you support at-risk clients, say so in the intake: we do not open installers from chat, we do not run remote-support tools from a stranger, and we will call you on a number we already have if something looks off. That is cheaper than pretending a Windows shop laptop is not also a journalist's machine.

What we would do if this is in your threat model

• Read the NCSC/FBI/AIVD advisory and the FBI FLASH. Share the non-technical half with staff who talk to at-risk clients.
• Treat unexpected remote-support or installer files from messaging apps as hostile until proven otherwise.
• If a client or staff member may have been hit, preserve the device and report. UK: NCSC. US: IC3. Netherlands: the channels in the advisory. In Canada, start with your incident process and counsel, then the appropriate law-enforcement cyber unit.
• Look for leak-site mentions of names you support. That is a safety issue. Do not amplify the dump.

Bottom line

State spyware aimed at people, not at your ERP. Forensic Five is in St. Albert, Alberta. We do scoped assessments. We do not pretend a mail gateway covers a Telegram lure. If you hold files for people who might be in that targeting set, say so when you ask for a review. We will scope to that, and we will stop at what we can verify.