CHOSEN BRICK / HEAVYGRAM — Iranian MOIS Spyware Targeting Dissidents, Activists & Journalists

On 15 September 2026 the UK National Cyber Security Centre, US Federal Bureau of Investigation, and Netherlands' AIVD published a joint advisory on a Windows-only malware family that Iranian state cyber actors have used since at least the fall of 2023 to surveil individuals perceived as threats to the Iranian regime. NCSC tracks the core implant as CHOSEN BRICK; the FBI's companion FLASH report (an update to FLASH-20260320-001) analyzes seven related samples under the name HEAVYGRAM and attributes the campaign to Iran's Ministry of Intelligence and Security (MOIS), which the FBI assesses uses it to "collect intelligence, conduct data leaks, and inflict reputational harm against their intended targets." Victims documented in the UK, US and Netherlands include dissidents, journalists, and members of organizations whose views run counter to Government of Iran narratives; some victims' personal data has subsequently appeared on pro-Iranian leak sites, and Iranian intelligence services have in some cases plotted kidnap or lethal operations against people they see as enemies of the regime.

The intrusion pattern is social-engineering-first: the actor builds rapport with a target over WhatsApp, Telegram, or Instagram — often posing as a known contact or as platform "technical support" — then delivers a file disguised as a legitimate application (Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, KeePass, a bespoke "Telegram Authenticator") or a fabricated MRI scan result. The dropper shows the victim a convincing fake UI while silently staging a persistent implant. Persistence is a single, consistent registry mechanism — HKCU\Software\Microsoft\Windows\CurrentVersion\Run — under value names including SMQDService, winappx, MicDriver and Default_SSH, each pointing at a binary the FBI's malware analysis fully hashed (§4, §10). Every implant checks in to a per-victim Telegram bot for command and control (an explicit OPSEC choice to prevent cross-contamination between victims), and exfiltrates collected data either through that same bot or to legitimate cloud object storage (VultrObjects, StorjShare); NCSC notes recent variants add an HTTPS/SOCKS5 proxy layer (IPRoyal, LightningProxies) in front of the Telegram traffic. Additional downloaded malware is deliberately written to C:\Windows \SysWOW64 — note the injected space after "Windows," a masquerading path that does not exist on a real Windows install.

Capabilities documented across the seven FBI-analyzed samples go well beyond the NCSC summary: process/system enumeration, screenshot capture, microphone recording (with a one-minute silent WAV played to disguise the recording indicator), Chrome saved-password decryption, Gmail OAuth token theft via a Selenium-driven browser flow, Outlook mailbox harvesting, USB/MTP phone-storage exfiltration, and WhatsApp/Telegram browser-cache theft. This is deliberately a social/personal-device threat as much as a corporate one — NCSC explicitly notes the actor pivots to personal devices when corporate controls block delivery, so this pack's mitigations extend past the managed fleet.

Decisions: the two government-source PDFs (NCSC advisory, FBI FLASH) are the backbone of every atomic IOC in this pack — both were fetched and parsed to extracted text and saved verbatim as source snapshots before any query or IOC was written (gate 4d). Where the NCSC prose and FBI deep-dive disagree on a spelling — NCSC's summary writes the SMQDService dropper as smdqservice.exe, while the FBI's sample-level analysis (with hashes) spells the same binary smqdservice.exe — both spellings are carried in the hunt queries and IOC table rather than silently picking one, since both strings are independently sourced. No IOC in this pack is shipped without appearing verbatim in a saved snapshot; where public reporting did not provide a durable atomic indicator (no C2 IP addresses were published, and Telegram bot tokens/IDs rotate per victim), the pack ships a behavioral signal instead of inventing one.

Working hypothesis: MOIS-affiliated actors build rapport with a target over WhatsApp/Telegram/Instagram (often posing as IT support or a known contact), deliver a masquerading installer or offer AnyDesk-based "support," the dropper shows a fake UI while staging a Python-based persistent implant under a Registry Run key, the implant registers a unique mutex and reports to a per-victim Telegram bot, evades Microsoft Defender by adding path/extension exclusions, then harvests contacts/email/browser data/screenshots/audio and exfiltrates via the Telegram bot and/or cloud object storage — optionally fronted by an HTTPS/SOCKS5 proxy.

N1 · Manual Run-key check (regedit / PowerShell)

NCSC's own recommended first check — works on any Windows device, managed or personal, with no EDR required.

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
# Or in PowerShell:
Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'
# Flag any value named SMQDService, winappx, MicDriver, or Default_SSH,
# or any value whose data path is unfamiliar / points into ProgramData or AppData.

N2 · Windows Defender exclusion audit (Event ID 5007)

Every exclusion CHOSEN BRICK adds is logged by Defender itself if operational logging is enabled — this catches the defense-evasion step even on a host without Falcon.

Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" |
  Where-Object { $_.Id -eq 5007 -and $_.Message -match 'Exclusion' } |
  Select-Object TimeCreated, Message
# Also review current exclusions directly:
Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension

N3 · PowerShell Script Block Logging (Event ID 4104) for exclusion commands

Catches the Add-MpPreference -ExclusionPath/-ExclusionExtension commands themselves in the PowerShell operational log, useful where the endpoint predates Falcon deployment or logging.

Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" |
  Where-Object { $_.Id -eq 4104 -and $_.Message -match 'Add-MpPreference' } |
  Select-Object TimeCreated, Message

N4 · Sysmon Event ID 1 / 13 fallback (no Falcon sensor)

For personal or unmanaged devices where Sysmon is the only available telemetry: hunt process creation for the masquerading installer names and registry-set events for the same Run-key values as Q1/Q2.

# Sysmon Event ID 1 (process create) - masquerading installer names
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
  Where-Object { $_.Id -eq 1 -and $_.Message -match 'Pictory_premium|Telegram_Authenticator|smqdservice|smdqservice|winappx|MicDriver|RuntimeSSH|MsCache' }
# Sysmon Event ID 13 (registry value set) - Run key persistence
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
  Where-Object { $_.Id -eq 13 -and $_.Message -match 'CurrentVersion\\Run' -and $_.Message -match 'SMQDService|winappx|MicDriver|Default_SSH' }

N5 · DNS / web-proxy review for C2 and exfil domains

For network appliances outside EDR visibility (home routers, guest networks). Treat every domain here as dual-use hunt-only context — never block.

# Review DNS/proxy logs for unexpected connections to:
api.telegram.org           # per-victim C2 bot (legitimate service)
vultrobjects.com storjshare.io backblazeb2.com   # exfil cloud storage (legitimate services)
iproyal.com lightningproxies.net                  # proxy fronting (legitimate services)
# A hit alone is not malicious - correlate against which PROCESS made the connection (Q5-Q7).

N6 · Personal-device / out-of-band user guidance

Not a query — a runbook item. NCSC explicitly recommends distributing this advisory to staff likely to be targeted (dissidents, journalists, activists, anyone with a public profile critical of the Iranian regime) and supporting them in checking personal devices, since the actor deliberately shifts delivery there when corporate controls interfere.

Grouped IOC Quick-Copy

Every value below appears verbatim in the NCSC advisory PDF and/or FBI FLASH report saved as this pack's source snapshots. Dual-use domains are marked hunt-only and must never be imported as block/prevent.

type,value,action,severity,expiration,description,tags
sha256,e8b633dcad173eb41ef02686b46779a4a0e53df7f6c63039a798f2db5eb83afc,detect,high,2027-03-16,Pictory_premium_ver9.0.4.exe masquerading dropper,campaign:CHOSEN_BRICK
sha256,9014fe4f16f01c0439b261ade4cf980f460e0dae46b1ec5f58fd9bc0af26e531,detect,high,2027-03-16,Telegram_Authenticator.exe masquerading dropper,campaign:CHOSEN_BRICK
sha256,8b595258cff63c4f0ef9648adb54c6ab050bb1d27933ecb3d687d31b51b7ba0c,detect,high,2027-03-16,winappx.exe persistent implant,campaign:CHOSEN_BRICK
sha256,4a3b003994112b4dd24ac8b9cc4757f4a12576b57b3cc8f5028d85fbceb7c405,detect,high,2027-03-16,smqdservice.exe persistent implant,campaign:CHOSEN_BRICK
sha256,c2dd678511373dc07e73ef1a580fc3332e640f15ff0d4c1044d4b9f305b6f503,detect,high,2027-03-16,KeePass.exe malicious masquerading implant,campaign:CHOSEN_BRICK
sha256,4908c0bc11a933d83c83935d9468ba8d08bc23529e5ff4d4344d4f0787b84bb6,detect,high,2027-03-16,MsCache.exe Gmail OAuth token stealer,campaign:CHOSEN_BRICK
md5,ebdd9595b79b39f53909d862499dbc94,detect,high,2027-03-16,RuntimeSSH.exe persistent implant (SHA256 not published),campaign:CHOSEN_BRICK
md5,f8b5554808428291acc65d1fd2efe01c,detect,high,2027-03-16,MicDriver.dll microphone-capture module (SHA256 not published),campaign:CHOSEN_BRICK

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  Value: SMQDService -> C:\ProgramData\SMQDServicePackages\...\smqdservice.exe  (NCSC prose spells it smdqservice.exe)
  Value: winappx     -> %ALLUSERSPROFILE%\MicrosoftDistribution\sysmain\winappx.exe
  Value: MicDriver   -> C:\ProgramData\Drivers\MicDriver\MicDriver.exe
  Value: Default_SSH -> C:\ProgramData\ssh-cache-default\{8bda3848-495e-43f4-8d10-7d37a67f1604}\RuntimeSSH.exe
Masquerading deploy dir (note trailing space): "C:\Windows \SysWOW64"
Observed fileless process image in that dir: bthudtask.exe (no backing file on disk)

ytyjyujyu             # RuntimeSSH.exe
noi672pp434awkc12f    # KeePass.exe (malicious)
nih6723443489kcvrf    # smqdservice.exe
euyrsmnszb85sf4444s   # winappx.exe
# No native Falcon telemetry for mutex creation -- see section 15 coverage GAP.
# Use for memory-forensic / YARA-based triage, not a CQL query.

api.telegram.org          # per-victim C2 bot - legitimate service, DUAL-USE, never block
vultrobjects.com          # exfil cloud storage - legitimate service, DUAL-USE, never block
storjshare.io             # exfil cloud storage - legitimate service, DUAL-USE, never block
backblazeb2.com           # exfil cloud storage - legitimate service, DUAL-USE, never block
iproyal.com               # proxy fronting (newer variants) - legitimate service, DUAL-USE, never block
lightningproxies.net      # proxy fronting (newer variants) - legitimate service, DUAL-USE, never block

Registry Run-key value named SMQDService / winappx / MicDriver / Default_SSH
Process image path containing "\Windows \SysWOW64\" (literal trailing space -- not a real path)
Fileless process image "bthudtask.exe" with no backing file on disk
PowerShell/cmd invoking Add-MpPreference with -ExclusionPath or -ExclusionExtension
Non-Telegram process resolving api.telegram.org (per-victim bot C2)
Non-browser process opening Chrome "Login Data" or "Local State" (credential/OAuth theft)
Masquerading installer names: Pictory_premium, Telegram_Authenticator, KeePass.exe, RuntimeSSH.exe, MsCache.exe, MicDriver.exe/.dll

CHOSEN BRICK    # NCSC name for the core Windows implant family
HEAVYGRAM       # FBI name for the same malware family (FLASH update to FLASH-20260320-001)
Attribution: Iran Ministry of Intelligence and Security (MOIS)
Also referenced alongside the "Handala Hack" persona (Stryker attack, FBI Director email leak)
Active since: at least Fall 2023; joint advisory published 2026-09-15 (NCSC/FBI/AIVD)
Targets: dissidents, journalists, activists, and individuals opposing Iranian regime narratives (UK, US, Netherlands documented)

This is a social-engineering-led, single-host implant with no lateral movement observed — the highest-leverage controls are (1) closing the specific persistence/evasion techniques used, and (2) reducing the odds the social-engineering lure ever executes.

1 · Audit and remove CHOSEN BRICK Run-key persistence

Prerequisites: local admin or EDR remote-response session on the target host
Reboot required: no
Rollback: re-add the value manually if removed in error (unlikely -- these value names are not legitimate)

# Check first:
Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' |
  Select-Object SMQDService, winappx, MicDriver, Default_SSH
# Remove a confirmed-malicious value:
Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'SMQDService' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'winappx' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'MicDriver' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'Default_SSH' -ErrorAction SilentlyContinue

2 · Revert Microsoft Defender exclusions added by the implant

Prerequisites: local admin; confirm the paths below via N2 audit before removing (do not blind-remove exclusions you did not verify)
Reboot required: no
Rollback: re-add the exclusion path if a legitimate application depended on it (verify against change-management records first)

Remove-MpPreference -ExclusionPath 'C:\ProgramData\MicrosoftDistribution\sysmain'
Remove-MpPreference -ExclusionPath 'C:\ProgramData\SMQDServicePackages'
Remove-MpPreference -ExclusionPath "$env:USERPROFILE\Downloads\Telegram Desktop"
Remove-MpPreference -ExclusionExtension 'C:\ProgramData\MicrosoftDistribution\sysmain\winappx.exe'
# Re-run a full Defender scan after clearing exclusions:
Start-MpScan -ScanType FullScan

3 · Application allowlisting for ProgramData/AppData execution (WDAC baseline)

Prerequisites: pilot ring first; inventory legitimate ProgramData/AppData-installed software before enforcing
Reboot required: yes (WDAC policy refresh typically requires reboot to fully apply in enforced mode)
Rollback: redeploy the prior WDAC policy XML (keep a versioned copy before every policy change) or switch policy to Audit mode

# Author/update a WDAC policy denying execution from user-writable paths, then:
Set-RuleOption -FilePath policy.xml -Option 3 -Delete   # remove Audit mode
ConvertFrom-CIPolicy -XmlFilePath policy.xml -BinaryFilePath policy.bin
Copy-Item policy.bin 'C:\Windows\System32\CodeIntegrity\SIPolicy.p7b'
# Validate the effective policy before wide rollout:
Get-CIPolicy -Path 'C:\Windows\System32\CodeIntegrity\SIPolicy.p7b'

4 · Hunt, isolate and preserve a confirmed host (Falcon)

Prerequisites: Falcon RTR access; legal/IR sign-off for network containment
Reboot required: no (network containment does not require a reboot)
Rollback: lift network containment once triage/eradication is confirmed complete

# Confirm with Q1-Q8, then network-contain via Falcon Host Management.
# Preserve memory/mutex artifacts before remediation (mutex list is not directly
# queryable in CQL -- collect via memory acquisition or a targeted YARA sweep).
# Do NOT add the dual-use domains (Q5-Q7) to any block policy -- contain the HOST, not the service.

Validation gates: confirm Falcon registry/process/DNS/file telemetry is enabled and retained on managed hosts; baseline sanctioned ProgramData/AppData software, RMM tooling, and approved proxy vendors before promoting Q2/Q4/Q6/Q7 to alerting; lab-test benign analogs for Q1/Q4/Q8; promote Q1 and Q3 (near-zero legitimate collision) to blocking IOAs and keep the rest as tuned hunts. Mutex, screenshot, microphone and MTP-exfil capabilities are documented GAPs with no native Falcon telemetry — close them with memory forensics, OS privacy-audit logging, or DLP rather than pretending a CQL query covers them.

HuntPack v0.1 · CHOSEN BRICK / HEAVYGRAM (Iranian MOIS spyware) · Generated 2026-09-16 · Defensive use only — no offensive code. api.telegram.org, vultrobjects.com, storjshare.io, backblazeb2.com, iproyal.com and lightningproxies.net are legitimate dual-use services — hunt-only context signals throughout this pack, never block/prevent. Validate field names and tune benign baselines before promoting any query to alerting.