NCSC, FBI and AIVD expose Iranian spyware Chosen Brick and HEAVYGRAM
On 15 September 2026 the UK NCSC, the FBI and the Dutch AIVD issued a joint advisory on Windows spyware linked to Iranian intelligence, tracked as Chosen Brick and HEAVYGRAM. The malware spreads via WhatsApp and Telegram under the guise of acquaintances or tech support, and reports through per-victim Telegram bots plus Vultr, Storj and Backblaze B2 storage.
- Campaign dates to autumn 2023, with tooling in use since at least 2025
- Implant captures screenshots, microphone audio, browser passwords and Telegram/WhatsApp data
- Command and control runs through a per-victim Telegram bot; exfiltration uses Vultr, Storj and Backblaze B2
- Persistence via registry Run keys and added Defender folder exclusions
Read next
Security