CyberNew CyberNew
Ransomware & Malware The Record 1 month ago

Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: CRITICAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’ British, American and Dutch security agencies issued a warning on Tuesday exposing a spyware tool being used by Iranian state-sponsored hackers to target individuals perceived as posing a threat to the regime. The malware, named CHOSEN BRICK by British intelligence, has been delivered using a range of lures — including a..."

Recommended Defense & Mitigation

  • Emergency Patching: Prioritize vendor patches and CVE mitigation across internet-facing assets immediately.
  • Perimeter Audit: Inspect perimeter firewall logs and hunt for unauthorized RCE indicators.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
iran lure

Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’

British, American and Dutch security agencies issued a warning on Tuesday exposing a spyware tool being used by Iranian state-sponsored hackers to target individuals perceived as posing a threat to the regime.

The malware, named CHOSEN BRICK by British intelligence, has been delivered using a range of lures — including a fake MRI scan of a disk herniation — sent to victims after extensive social engineering campaigns to earn their trust.

According to the United Kingdom’s National Cyber Security Centre (NCSC), Iran has used this and similar cyber activity to “support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists.”

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →