Agencies differ on when HEAVYGRAM/CHOSEN BRICK targeting began
Assessment
Coverage of the September 15, 2026 joint advisory states the FBI "dates the wider campaign to the autumn of 2023" — shortly after Handala Hack's emergence — while the NCSC's own advisory text states CHOSEN BRICK "has been used to target individuals around the world including in the UK, US and the Netherlands from at least 2025." These are not necessarily contradictory (one may describe the actor's broader Telegram-C2 activity, the other a narrower confirmed-victim window for the specific malware family analyzed), but the two dates are reported without that distinction being made explicit anywhere in the public-facing materials, and a reader comparing the two advisories side by side would reasonably read them as conflicting.
Where this claim appeared
The Hacker News / National Cyber Security Centre · 2026-09-15
https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalistsWhat “Unverified” means
Widely repeated, but no supporting evidence was located. This is not a statement that the claim is false — it is a statement that nothing published supports it, which is a different and more common problem.
2 of 5 · rating scale
Assessed in
Handala Hack's HEAVYGRAM Backdoor (CHOSEN BRICK) Spies on Iranian Dissidents via Telegram C2Think this assessment is wrong? Report an error.