Threat Intelligence Brief
Curated summary with source attribution
Source: shattered.io
Threat Risk: High
Victim: Journalists, activists, and human rights defenders
Incident: A Windows-based spyware campaign deploying the CHOSEN BRICK (also known as HEAVYGRAM) malware.
Impact: Complete system compromise leading to the theft of sensitive files and persistent surveillance.
Attacker: Iran’s Ministry of Intelligence and Security (MOIS)
Analysis: The campaign utilizes targeted social engineering on messaging platforms like WhatsApp and Telegram to deliver Windows-based payloads. By masquerading as trusted contacts, attackers trick victims into opening malicious files that grant full system access. The operation leverages Telegram bots for command and control, blending in with legitimate traffic to exfiltrate data.
Recommendations: Verify the identity of senders on messaging apps via a secondary channel before opening attachments.; Implement robust endpoint protection to detect and block unauthorized payload execution on Windows systems.; Educate high-risk users on the dangers of tailored social engineering lures, such as fake password managers or medical files.
Source: Shattered.io
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source