Iranian spies hit Windows machines with Chosen Brick data-stealing malware Iranian state cyber actors are targeting individuals using social messaging apps to deploy surveillance and data-stealing malware on their Windows machines, three Western governments warned. In all observed cases, Chosen Brick has infected Windows systems exclusively. Iran has used it since at least 2025 to take over individuals …
1 - Stop using Windows.
2 - If you absolutely have to (SCADA has a long life), keep it several layers away from the Internet
3 - If you absolutely have to remote anything, use cert based connectivity, or at a minimum passkey of MFA protected logins.
4 - no external engineers with unscreened laptops. It's not worth it.
> You're not underground son, you're just unpopular.
OpenVMS on DEC Alpha while not popular (and now probably extinct) would still be a much harder nut to crack with a brick or otherwise.
I know one wealth management business here ran their IT on this platform into the 2000s.
"using the same registry key that Chosen Brick uses to establish its own persistence on a Windows device: HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
"After building rapport with the mark, the attackers convince them to download and open a file that appears to be a legitimate application" Adobe Flash Player
I'm sorry but what year is it? Did I step into a time machine without noticing?
Are people really still opening exe files from emails or unknown sources and how do they even have the ability to run these exe files? The early 2000's called and they want their tillseptemberends.exe mp3 back.
> They [the idiots] are deeply offended.
They hold they aren't sufficiently intelligent to be "Trumpettes" ?
(Remember they are called idiots for a reason,)
The whole boiling would hardly have the combined intellect to the plumb the depth of of a teaspoon so I would contend any offence would neccessarily be exceedingly superficial.
> They are targeting people like Agent Orange (trump) because they know he, his family and his followers are idiots.
So more or less the whole nation then ?
Rather apt that the phrase "shooting fish in a barrel" was originally American (and as Izaak Walton would hold, unsporting.)
The part I do not get is how people can install apps from random sources just because someone told them to. And Flash player of all things (some other seem more reasonable). If the head of IT told me in person to install Flash player on any device, I would just laugh in his face.
what about for data recovery?
Not from Flash files. Lots (too many) applications used flash for their installer, GUI, one (xcelsius) for creating dashboards for your own data analytics.
I.T might just get a chance to use the magic cloth. The one used to wipe smiles off faces.
I would say that if you're performing data recovery for old data formats, especially those that need obsolete applications, the place to do this is as far from the internet as possible, in a secure an environment, or possibly even in complete isolation from everything else.
It's true that air-gapped environments can be attacked, but you generally need some vector, which in the case of the original SCADA and Stuxnet that everyone quotes, was idiots with USB sticks, but without these, isolated is pretty secure.
Known supplier of certain powertrain components had a software tool that was 1) driver for the adapter that could talk to their control module on SAE J1939 (CAN bus), 2) live telemetry from said module, 3) reconfiguration of module (must have supplier's secret engineer password), and 4) help files to understand the internals of the main product to which the control module was connected. These help files included some Flash animations of the internal fluid flows of this product, and the user could select views of various product modes to see how the flows were affected. I can't remember if the Flash diagram was linked to telemetry in any way, or if the main program used Flash for its gauge animations -- the main point is that any laptop that contained this program also HAD to have Flash.
I was keeper of that special test laptop (along with some other test assets including other laptops) for about 3 years, which I updated diligently (Windows, Flash, other things) even though it was primarily air gapped (physical wi-fi radio switch, but no other lockout). That was about 10 years ago, and I don't know what their software requires now.
Number one rule for any internet connected device. If someone asks you to download and install an App. You go to the relevant App store (not via a link given to you by said person), and download the relevant App there. Making sure you get the correct popular App downloaded millions of times previously.
Actually, this article talks about windows. Who the hell runs a program on their computer, just because some random tells them to? I'm forever astounded by humanity...
Iranian spies, Russian Spies, Chinese spied and North Korean spies. Its a different one each month. I am waiting to hear about the Danes (or venezualeans, or the Houthi)
Why do these low budget enemies seem to always be attacking everyone when the western ones dont?
Do they hate our freedom or something?
There is no news here - everybody (including your government, wherever you are) are spying on you. So much so, I am surprised your computer still manages to boot.
"Why do these low budget enemies seem to always be attacking everyone when the western ones dont?"
Are you familiar with the acronyms CIA or NSA? How about GCHQ (U.K.)? Or Unit 8200 (Israel)? Or CNI (Mexico)?
In reality most every country is likely spying on/attacking/prepared to attack other countries. They'd be remiss if they weren't.
ITsec has always used English to make themselves appear as ridiculous as they actually are.
The unfortunate block has been taken behind the barn and given a good whack with a lump hammer then ?
Concerned organisations ? The bricklayers guild might be a bit miffed over the use of scab labour.
