Intelligence Brief: Iranian State-Linked Actors Deploy CHOSEN BRICK Malware via Telegram C2

Executive Summary

In the last 72 hours, the Encrygma Threat Intel Unit has observed a significant escalation in espionage operations attributed to Iranian state-linked threat actors. The campaign centers on the deployment of a modular malware strain identified as CHOSEN BRICK. Unlike traditional malware that relies on dedicated, easily blockable C2 infrastructure, this actor has pivoted to using Telegram as a primary communication channel for exfiltration and command execution. This shift represents a tactical evolution designed to evade standard perimeter defenses.

Background & Context

The threat landscape in September 2026 remains highly volatile, characterized by a mix of state-sponsored espionage and opportunistic exploitation of zero-day vulnerabilities. The emergence of CHOSEN BRICK follows a broader trend of threat actors moving away from static infrastructure toward living-off-the-land (LotL) techniques and encrypted messaging platforms for C2. This specific campaign targets individuals and organizations deemed hostile to Iranian state interests, focusing on long-term persistence and data exfiltration.

Analysis

The CHOSEN BRICK malware is designed for stealth. By utilizing Telegram’s API, the malware masks its traffic as legitimate user activity, making it exceptionally difficult for traditional firewalls and IDS/IPS solutions to flag the communication as malicious. The malware is often delivered via spear-phishing campaigns that exploit unpatched vulnerabilities in common software frameworks. Recent intelligence confirms that the actors are actively weaponizing CVE-2026-89026 (Issabel Framework) to achieve unauthenticated OS command execution, providing them with a foothold to deploy the CHOSEN BRICK payload.

Key Findings

• C2 Evolution: The use of Telegram as a C2 channel significantly complicates traffic analysis and attribution.
• Targeting Profile: The campaign is highly focused on dissidents and activists, suggesting a political rather than purely financial motivation.
• Vulnerability Exploitation: Attackers are actively leveraging CVE-2026-89026 (Issabel Framework) and CVE-2026-58704 (Google Pixel Modem) to facilitate initial access and privilege escalation.
• Persistence: The malware is designed to maintain long-term access, allowing for the dynamic deployment of additional modules based on the victim's profile.

Attribution & Confidence

We assess with high confidence that this campaign is linked to Iranian state-sponsored actors. The TTPs, including the specific targeting of dissidents and the use of custom malware like CHOSEN BRICK, align with historical patterns observed in Iranian cyber-espionage operations. The intelligence is corroborated by recent reports identifying the use of Telegram-based C2 in similar regional campaigns.

Defensive Recommendations

1. Network Segmentation: Restrict outbound traffic to messaging platforms like Telegram from sensitive internal segments where such communication is not required for business operations.
2. Patch Management: Prioritize the immediate patching of the Issabel Framework (CVE-2026-89026) and ensure all mobile devices are updated to mitigate CVE-2026-58704.
3. Endpoint Monitoring: Implement behavioral detection rules to identify suspicious PowerShell or command-line activity originating from web-facing applications.
4. Email Security: Enhance spear-phishing awareness training, specifically focusing on the identification of malicious LNK files and disguised executables.

Outlook

We anticipate that the use of encrypted messaging platforms for C2 will continue to rise as threat actors seek to bypass increasingly sophisticated network monitoring tools. Organizations should prepare for a sustained period of high-intensity espionage activity. Encrygma will continue to monitor for new variants of CHOSEN BRICK and provide updates as the situation evolves.