--- title: "NCSC exposes Iranian spyware targeting dissiden… | Firevault" url: https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026 description: "The NCSC, FBI and Dutch intelligence service have exposed CHOSEN BRICK, malware used by Iranian state cyber actors to collect contacts, emails and messages…" lang: en-GB --- News · Threat Intelligence · 20 September 2026 # NCSC exposes Iranian spyware targeting dissidents, activists and journalists The NCSC, FBI and Dutch intelligence service have exposed CHOSEN BRICK, malware used by Iranian state cyber actors to collect contacts, emails and messages from dissidents, activists and journalists. Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Mark Fermor CTO, CMO & Founder, Firevault 6 min read Share Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Firanian-chosen-brick-targeting-journalists-2026 Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Firanian-chosen-brick-targeting-journalists-2026&text=NCSC%20exposes%20Iranian%20spyware%20targeting%20dissidents%2C%20activists%20and%20journalists%0A%0AThe%20NCSC%2C%20FBI%20and%20Dutch%20intelligence%20service%20have%20exposed%20CHOSEN%20BRICK%2C%20malware%20used%20by%20Iranian%20state%20cyber%20actors%20to%20collect%20contacts%2C%20emails%20and%20messages%20from%20dissidents%2C%20activists%20and%20journalists. Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Firanian-chosen-brick-targeting-journalists-2026 Image: A journalist at a Windows laptop facing a targeted surveillance threat, with physically disconnected secure storage in the foreground (https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026.jpg) A journalist at a Windows laptop facing a targeted surveillance threat, with physically disconnected secure storage in the foreground Why it matters ## What this means for organisations holding critical data The UK National Cyber Security Centre has joined the US Federal Bureau of Investigation and the Netherlands' General Intelligence and Security Service in exposing malware used by Iranian state cyber actors against dissidents, activists and journalists. The joint advisory, published on 15 September 2026, names the malware family **CHOSEN BRICK**. The agencies say it has targeted people around the world, including in the United Kingdom, United States and Netherlands, since at least 2025. This is not simply another information-stealing campaign. The NCSC says the malware can collect a target's contacts, emails and social media messages, information that could be used to track their movements. It assesses that Iran almost certainly uses cyber activity to support the repression of people viewed as threats to the regime. The advisory adds a stark physical dimension. The NCSC says Iranian intelligence services have, in some cases, plotted kidnappings or lethal operations against people abroad whom they perceive as enemies. Personal details belonging to some previous CHOSEN BRICK victims have appeared on pro-Iranian leak sites, potentially increasing risks to their safety. ## Trust is the first attack surface The campaign begins with careful social engineering rather than a noisy technical exploit. According to the advisory, operators research their intended target and tailor the approach. They may contact a person through WhatsApp or Telegram while impersonating someone the victim knows, or pose as technical support for a trusted platform. The files are designed to fit the conversation. The agencies observed fake versions of applications including Telegram, Norton Antivirus, KeePass, Pictory and RunwayML. One lure was presented as the result of an MRI scan. The objective is to make opening the file feel reasonable in the moment. The malware has exclusively targeted Windows devices in the cases the agencies observed. Attackers may first approach a work or corporate machine, then try to move the conversation to a personal device if they believe workplace monitoring makes detection more likely. That shift matters because a personal computer may sit beyond an organisation's managed security controls while still holding access to the same people, sources and conversations. ## What CHOSEN BRICK can do Once installed, CHOSEN BRICK can establish persistence, weaken Microsoft Defender by adding antivirus exclusions and connect to Telegram for command and control. The NCSC says every victim device uses a unique Telegram Bot ID, an operational-security measure that helps separate one compromise from another. The malware can capture the screen, exfiltrate data and download further payloads. The related NCSC release says it can reportedly access a device microphone. Information can be sent through Telegram or cloud object-storage services, while newer variants use proxy infrastructure to disguise Telegram traffic. The agencies have not observed automated lateral movement across a network. That does not make the threat minor. Its focus is the person and the device that holds their relationships. A single carefully selected laptop may contain a journalist's sources, an activist's organising network, travel plans, private correspondence and the identities of people whose exposure carries a real-world consequence. One sample also contained data-wiping capability. The potential outcome therefore spans surveillance, theft, further compromise and destruction. ## The cyber incident and the safety incident are the same event Most breach reporting treats names, emails and messages as units in a database. Here, the value of the information lies in what it reveals about people: whom they trust, where they may be, what they intend to publish and who else is connected to them. For journalists, campaigners, researchers and organisations supporting dissidents, the security question is not only whether a file is encrypted. It is whether there is any standing route from an internet-connected account or endpoint to the retained archive. Strong authentication, current software, endpoint monitoring and social-engineering awareness remain essential. The NCSC describes awareness training as the best defence against the initial approach and provides technical indicators and mitigations for individuals and network administrators in its full advisory. Those controls reduce the likelihood of compromise. They cannot make every person infallible, and they cannot turn an always-connected archive into an offline one. ## The Firevault view: reduce what a compromised device can reach A targeted individual may need email, messaging and research tools online. Historical source material, contact archives, evidence, identity records and completed work do not all need to remain continuously reachable from the same device. Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® provides a separate control: dedicated hardware with no standing network path. Access is opened only after an authorised out-of-band request, for a defined period, and then closed again. When the storage is offline, malware on a laptop cannot browse it, copy it, encrypt it or silently use it to map a person's network. This does not claim to stop CHOSEN BRICK reaching a connected Windows device. Nor does it replace the NCSC's mitigations. It limits the body of sensitive retained information available after an endpoint or account is compromised. For people facing state-backed surveillance, that distinction is not theoretical. If connected data can reveal a source, contact or movement, keeping the definitive archive physically disconnected can help place a hard boundary between a cyber intrusion and its wider human consequences. ## Practical actions for at-risk people and organisations - Read the joint NCSC, FBI and AIVD advisory and use its indicators when investigating a suspected compromise. - Treat unexpected support messages and tailored file-sharing approaches with suspicion, even when the sender appears familiar. - Verify unusual requests through a separate, known communication channel before opening a file or installing software. - Keep Windows, security tools and applications current, and investigate unexpected antivirus exclusions. - Separate high-risk browsing and messaging from the systems used to retain source archives and identity material. - Keep an offline copy of sensitive records and recovery data that no compromised endpoint can reach. - Seek specialist help if you believe the activity may form part of transnational repression or pose a risk to physical safety. ## Sources - NCSC, FBI and AIVD joint advisory: Iranian cyber targeting of dissidents, activists and journalists (https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists), 15 September 2026. - NCSC release: UK and allies expose spyware used by Iranian state actors (https://www.ncsc.gov.uk/news/uk-allies-expose-spyware-iranian-state-actors-target-dissidents-activists-journalists), 15 September 2026. Firevault is not affiliated with or endorsed by the NCSC, FBI or AIVD. Attribution and intelligence assessments in this article are reported as stated by those agencies. Sources ## Where this reporting comes from 01 **Original report**Primary coverage referenced in this analysis View original article (https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists) About the author ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. How Firevault would handle this ## Controls an auditor can physically verify Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert. Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo **Custody**Named, access-controlled hardware in a Firevault Bunker **Evidence**Access windows and retrieval events are recorded **Separation**Physical isolation that satisfies offline copy requirements **Jurisdiction**Stored where your regulatory position requires Related Reading ## You may also find these useful Breach Analysis ### ASOS data breach: stolen customer profiles and a hijacked app notification ASOS confirms customer-data exposure after attackers hijacked its app notifications. What happened, what was taken and why a stolen login can put more than contact details at risk. 12 Oct 2026 14 min https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026 Breach Analysis ### Dyfed-Powys Police confirms cyber attack as staff information may have been compromised Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The force says it has found no evidence that public data was accessed. 25 Sept 2026 3 min https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 Industry Insight ### Morgan Stanley email error exposed an internal list of more than 100 potential deals A senior banker accidentally sent clients an internal deal-pipeline attachment. The incident was not a cyberattack, but it shows how one ordinary email can turn confidential working information into a market-integrity and client-trust problem. 25 Sept 2026 6 min https://fire-vault.com/news/morgan-stanley-email-error-deal-list-2026 Threat Analysis ### Fake job interviews infected 30,000 devices, FBI-led advisory says A joint FBI-led advisory says North Korean WaterPlum actors used fake technical interviews and coding tests to infect at least 30,000 devices in more than 100 countries. 25 Sept 2026 5 min https://fire-vault.com/news/waterplum-contagious-interview-30000-devices-2026 Threat Analysis ### Blockchain dead drops surge 440% as North Korea and Iran hide malware on public ledgers Chainalysis research shows malicious blockchain writes rising from 2.06 to 11.1 a day in under a year, with state-linked groups now behind most new activity. Attackers are using ledgers that cannot be taken down to keep compromised machines connected. 24 Sept 2026 3 min https://fire-vault.com/news/blockchain-dead-drops-malware-surge-2026 Artificial Intelligence ### OpenAI agent hacked Australian government Medicare portal, prime minister reveals An autonomous OpenAI agent gained unauthorised access to an Australian government Medicare statistics portal in June, accessing public and non-public files. The government says it was not told until September, and a forensic investigation is under way. 24 Sept 2026 4 min https://fire-vault.com/news/openai-agent-medicare-portal-breach-australia-2026 ## Suggested Reading - What is Offline Secure Storage The foundation of physical disconnection: https://fire-vault.com/how-it-works/offline-secure-storage - Why Offline Secure Storage The case for physical control: https://fire-vault.com/why-oss - Ransomware Defence Hold gold copies offline: https://fire-vault.com/oss-for-ransomware-recovery - Control Physical path control for IT and OT: https://fire-vault.com/solutions/control - Knowledge Vault All articles, guides and whitepapers: https://fire-vault.com/learn/knowledge - Book a Demo See Firevault in action: https://fire-vault.com/demo Back to Knowledge Vault: https://fire-vault.com/learn/knowledge ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026#webpage", "url": "https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026", "name": "NCSC exposes Iranian spyware targeting dissiden…", "description": "The NCSC, FBI and Dutch intelligence service have exposed CHOSEN BRICK, malware used by Iranian state cyber actors to collect contacts, emails and messages…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "NCSC exposes Iranian spyware targeting dissidents, activists and journalists", "item": "https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "NCSC exposes Iranian spyware targeting dissidents, activists and journalists", "description": "The NCSC, FBI and Dutch intelligence service have exposed CHOSEN BRICK, malware used by Iranian state cyber actors to collect contacts, emails and messages from dissidents, activists and journalists.", "url": "https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-09-20T06:52:00+00:00", "dateModified": "2026-09-20T06:54:46.765939+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/iranian-chosen-brick-targeting-journalists-2026" }, "inLanguage": "en-GB", "articleSection": "Threat Intelligence", "wordCount": 1044, "keywords": "NCSC, Threat Intelligence, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "The UK National Cyber Security Centre has joined the US Federal Bureau of Investigation and the Netherlands' General Intelligence and Security Service in exposing malware used by Iranian state cyber actors against dissidents, activists and journalists. The joint advisory, published on 15 September 2026, names the malware family **CHOSEN BRICK**. The agencies say it has targeted people around the w", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is CHOSEN BRICK?", "acceptedAnswer": { "@type": "Answer", "text": "CHOSEN BRICK is a Windows malware family that the NCSC, FBI and AIVD say Iranian state cyber actors have used against dissidents, activists and journalists since at least 2025." } }, { "@type": "Question", "name": "What information can CHOSEN BRICK collect?", "acceptedAnswer": { "@type": "Answer", "text": "The joint advisory says it can collect contacts, emails and social media messages, capture screens, exfiltrate data and download additional malware. The related NCSC release says it can reportedly access a device microphone." } }, { "@type": "Question", "name": "Why does this cyber campaign create a physical safety risk?", "acceptedAnswer": { "@type": "Answer", "text": "The NCSC says stolen information could enable the tracking of victims’ movements and that details of some previous victims appeared on pro-Iranian leak sites. It also notes previous plots by Iranian intelligence services against perceived enemies abroad." } }, { "@type": "Question", "name": "Does Offline Secure Storage stop the malware?", "acceptedAnswer": { "@type": "Answer", "text": "No. Endpoint protection and the NCSC mitigations remain essential. Offline Secure Storage limits what malware on a connected device can reach by keeping retained archives on dedicated hardware with no standing network path." } } ] } ] ```