When the managed device holds, this spyware asks for the personal one

On Monday the National Cyber Security Centre, the FBI and the Dutch AIVD published a joint advisory on a malware family the NCSC tracks as CHOSEN BRICK. It has been used against individuals in the United Kingdom, the United States and the Netherlands from at least 2025, and it targets the Windows operating system exclusively.

The advisory describes who is being attacked in unusually direct terms. The victims are dissidents, activists and journalists. The NCSC writes that Iran “almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime”, and it places that in a context most malware reporting never has to: “In some cases, the Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals internationally, who they perceive as enemies of the regime.”

The personal details of some earlier victims have appeared on pro-Iranian leak sites.

Most of the coverage will reasonably concentrate on that. This piece is about one sentence in the delivery section, because it describes a move that the security programme of almost every organisation reading this cannot answer.

The sentence

The actors approach targets through social messaging platforms, usually WhatsApp or Telegram, posing either as somebody the target already knows or as technical support from the platform itself. They build rapport first, using research done in advance so the approach sounds credible. Then they send a file.

The file is dressed to match the conversation. The advisory lists what the lures have imitated: Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player and KeePass. In other cases the file appeared to be MRI scan results. Whatever the theme, opening it shows a convincing screen while the real payload is fetched and run behind it.

Then comes the sentence:

“If the initial delivery fails or the risk of detection is deemed significant, the actor will attempt to transition the delivery to personal devices by asking the target to open the file on their own devices, evading corporate security controls that protect the individual.”

Read that as a control statement rather than as narrative. The attacker has encountered your allowlisting, your managed antivirus, your endpoint monitoring, your mail filtering. Those controls worked. The documented response is not a better exploit. It is a polite request to the human being to step outside them.

What lands, and what it can then do

CHOSEN BRICK survives a reboot using a registry Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, which needs no administrative rights and runs at each logon. It adds its own exclusions to Microsoft Defender to avoid being caught.

Command and control runs through Telegram. The capability list in the advisory is broad rather than specialised, which fits a tool built for surveillance of a person rather than intrusion into a network.

What the operator can task the malware to do

Function	Technique	Why it matters for a targeted individual
Capture screen content	T1113	The advisory says this is used to identify contacts, location and pattern of life
Enable the microphone	T1123	Audio capture of the room, not just the device
Copy Telegram and WhatsApp data from browsers	T1005	Reaches the messaging the person believed was private
Steal email content	T1114.001	Correspondence, including with sources or lawyers
Enumerate processes and system information	T1057, T1082	Reconnaissance and tailoring of later payloads
Download further files	Not stated	Additional malware, given persistence with the same registry key
Delete files, or wipe the system	T1485	Destruction is an available outcome, not only collection

Screen capture deserves the emphasis the advisory gives it. Against a company, screenshots are a data theft problem. Against a journalist, the same feature establishes who they meet, where they are and when they move. The advisory notes that in some cases the actors have chosen to publish what they retrieved in order to harass the victim further.

The detail that defeats how you would normally hunt this

Each infected device connects to a different Telegram Bot ID, unique to that victim. The advisory is explicit that this is deliberate operational security, “preventing cross-contamination between victims”.

That removes the shortcut defenders rely on. Normally one recovered C2 identifier unlocks the rest of a campaign: you pivot from an indicator to every other host talking to the same place, and you scope the incident in an afternoon. Here, each victim is an island. Finding one tells you almost nothing about the next.

The second problem is where the traffic goes. Every destination in the advisory is a service somebody in your organisation has a legitimate reason to use.

The domains the advisory asks you to look for

Destination	What it normally is	Role in this campaign
api[.]telegram[.]org	Telegram bot API	Command, control and exfiltration
vultrobjects[.]com	Vultr object storage	Bulk exfiltration of collected files
storjshare[.]io	Storj distributed storage	Bulk exfiltration of collected files
backblazeb2[.]com	Backblaze B2 storage	Listed among the services to investigate
iproyal[.]com	Commercial proxy provider	Obscuring the Telegram traffic
lightningproxies[.]net	Commercial proxy provider	Obscuring the Telegram traffic

Recent variants add HTTPS and SOCKS5 proxies specifically to hide the use of Telegram bots. So the detection you are being asked to build is not a blocklist. It is a judgement about whether a given person had any business talking to Telegram's bot API or a distributed object store at all, which requires you to know what normal looks like for that individual.

What the advisory does not establish

There is also a boundary worth respecting on capability. The advisory states plainly that the malware “has not been observed to have automated lateral movement capabilities and has focused on single devices”. It adds that because further malware can be downloaded, lateral movement is “technically possible although this has not been observed”. That is a careful distinction and it should survive into any briefing you write internally. This is a tool for getting inside one person's life, not for moving through an estate.

The part your policy does not cover

The advisory closes its investigation guidance with a recommendation that is easy to read past:

“As this actor targets personal devices, not just corporate devices, organisations are recommended to circulate this with their staff that are likely to be targeted and support them in checking their personal devices too.”

Consider what that asks of a newsroom, a university, a human rights organisation or any employer of somebody an authoritarian state dislikes. You are being asked to help an employee inspect a laptop you do not own, cannot enrol, have no logs from, and in most jurisdictions have no clear right to examine. There is no budget line for it. There is no runbook. The staff most likely to need it are often the most reasonably wary of handing their personal device to their employer's IT function.

This is the uncomfortable middle ground the attack is designed to occupy. The corporate device is defended and the personal device is where the person actually lives, so the operation simply moves there. Every control in the left column of the diagram above stops at the boundary of the asset register.

The honest answer is that helping here is mostly not a technology problem. It is deciding in advance who counts as a likely target, telling them plainly that the request to “just open it on your own laptop” is the documented attack, and offering support in a form they will accept, which usually means advice and a person to call rather than software on their machine.

The P.K. view

Three countries' security agencies co-signed this, which is worth noticing on its own. The technical content is competent and the tradecraft it describes is mostly unglamorous: rapport, a convincing file, a registry key, a Telegram bot.

The interesting part is the failure mode it documents. We have spent a decade hardening the managed endpoint, and on the evidence of this advisory that work succeeds often enough that the attacker has a rehearsed answer for it. The answer is not a zero-day. It is asking the target to use a different computer.

That should be uncomfortable for anyone who reports control coverage as a percentage of managed devices. The denominator in that metric is the estate. The denominator the attacker is using is the person. For most staff those are close enough that the distinction never matters. For the small number of people a state wants to reach, the gap between them is the entire attack surface, and it sits outside everything the security team is funded to see.

So the question this advisory leaves is not a technical one. It is whether your organisation can name the handful of people for whom the personal device is the real perimeter, and whether it has decided what it owes them before one of them is asked, on a Tuesday evening over WhatsApp, to open a file on the laptop at their kitchen table.