NCSC, FBI and AIVD Named Iran's CHOSEN BRICK Yesterday. Its Twelve Hashes Have Been in Our Index Since March 26 Under the FBI's Name. Then We Checked the File We Actually Serve. Zero of Twelve.
Yesterday the UK's National Cyber Security Centre, the FBI and the Netherlands' AIVD published a joint advisory on a Windows malware family they call CHOSEN BRICK. It is Iranian, it is aimed at dissidents, activists and journalists in the UK, the US, the Netherlands and elsewhere, it has been running since at least 2025, and the personal details of some of its victims have already turned up on pro-Iranian leak sites. That last sentence is the one that matters; the rest of this post is about receipts.
What it is
The chain is social engineering first and malware second. The operator builds rapport on WhatsApp or Telegram, posing as someone the target has reason to trust, and then delivers a file that matches the story: a fake Pictory or RunwayML installer, a fake Norton, a fake Telegram, a fake KeePass, an MRI scan result. The payload persists through the HKCU Run key, registers a mutex so it doesn't run twice, and talks to a Telegram bot for command and control, with a different bot per victim, sometimes behind an HTTPS or SOCKS5 proxy from a commercial reseller. Exfiltration goes out through Telegram and through ordinary cloud object stores. Once in, it enumerates processes, captures the screen, records the microphone, reads browser-stored chat data, steals email, drops second-stage payloads, and can wipe the machine. There is no automated lateral movement. It is built for one person's laptop.
The advisory publishes no hashes and no attacker IP addresses, because there are none worth publishing: every victim gets a fresh bot. What it does publish is host detection content, two Run-key values, SMQDService pointing at smdqservice.exe and winappx pointing at winappx.exe, two mutexes, a deployment directory with a space in the path, and six domains to watch for in DNS and proxy logs. Those six are api.telegram.org, Backblaze B2, Vultr object storage, Storj, and two proxy resellers. They are legitimate services. Under the rule we run, compromised or abused infrastructure is a victim and never goes in a blocklist, so none of those six will ever appear in our domains.csv, and if a feed you pay for puts them there, you should ask why.
Both timestamps
Here is the part where we would normally say "in our feed since." Let's do it properly.
On March 20, 2026, FBI FLASH-20260320-001 published twelve MD5 hashes of MOIS malware using Telegram bots as command and control. The lure filenames were KeePass.exe, Pictory_premium_ver9.0.4.exe, Telegram_Authenticator.exe, WhatssApp.exe with the typo. The implants were MicDriver, RuntimeSSH, MsCache, and two exfiltration components named smqdservice.exe and winappx.exe. We wrote them up on March 26 in the middle of the Handala work, ingested all twelve under the source name fbi-flash, and noted in that post that three GitHub repositories had carried the hashes before we did. We were fourth. We said so.
The September 15 advisory names the family, describes the same lures, the same two exfiltration implants, the same Telegram-bot C2, and the same targeting of the same people. It does not cite the March FLASH. Putting the two side by side is the correlation event: CHOSEN BRICK is the malware in FBI FLASH-20260320-001, and the Handala toolkit and the "Iranian state cyber actors" of yesterday's advisory share an exfiltration binary by name. That is our contribution. The hashes are the FBI's. The name is NCSC's. The connection is ours, and it is a connection, not a lead.
Today the twelve records got the family name attached. Source field unchanged, references to the advisory added, read back twelve of twelve.
Then we checked the file we serve
A write is not done until it is read back, and a record in an index is not a record in a feed until the file a defender downloads contains it. So after the update landed we pulled hashes.csv and searched it for the twelve.
Zero of twelve.
The hashes.csv route selects documents by a type field, and it accepts four spellings: sha256, md5, sha1 and hash. The FBI FLASH records were ingested in March with the type hash-md5. They never matched. Neither did anything typed filehash-sha256, filehash-md5, filehash-sha1, hash-sha1 or hash-sha256, which is how MalwareBazaar imports and most of the vendor-blog harvester's output are typed. The count of hash documents in our index that the served file has never carried is 51,808. At confidence 80 and above, the threshold our own edge shield enforces, it is 11,539: ten thousand from our own OTX pulses, six hundred from Elastic's research, four hundred from Check Point's, a hundred and sixty each from Microsoft's and Talos's, fifty from Volexity's, and the FBI's twelve.
Every one of those posts that said "the hashes are in the feed" was describing the index. The artifact disagreed the whole time, and nobody curled it. This is the same defect we found on Monday in the edge sensor, a unit mismatch that stayed green for twenty-nine days, wearing a different coat: a type string that stayed green for six months. The fix is one filter line and a deploy, and it is pending as this publishes. The correction is this paragraph.
What a defender should do with this
If you run Windows fleets that dissidents, journalists or exiled activists use, and that describes a lot of newsrooms and NGOs, query the HKCU Run key for the two value names, alert on the two mutexes, and treat unexpected api.telegram.org, Backblaze, Vultr and Storj traffic from a workstation as a question, not a block. Train the humans, because the first stage is a conversation, not an exploit. And if you pull our hashes.csv, know that until the fix ships it is missing the twelve FBI hashes and about eleven thousand others above our own confidence floor. We would rather you read that here than discover it from a compromise.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=ncsc-fbi-and-aivd-named-iran-s-chosen-brick-yesterday-its-twelve-hashes-have-been-in-our-index-sin
Comments