Photo by Christian Velitchkov on Unsplash
When the UK's National Cyber Security Centre puts out a warning, that is worth a few minutes of your time. When the FBI and the Dutch intelligence service AIVD coordinate on the same warning, published the same day, that is worth stopping what you are doing and reading properly. That is exactly what happened in September 2026 with something called CHOSEN BRICK spyware.
Most small business owners will not have heard of it. That is entirely fine. You do not need to know the technical internals of every threat to protect yourself from one. What you do need to understand is what three national cyber agencies collectively decided was serious enough to go public about together, and what the practical implications are for a business like yours.
What CHOSEN BRICK Is and Why the Joint Advisory Is Significant
CHOSEN BRICK is a piece of spyware. That puts it in a different category from the ransomware stories that tend to dominate the headlines. Ransomware makes noise. It locks your files, disrupts your operations, and presents you with a demand. Spyware does the opposite. It works quietly, and in many cases you would have no idea it was there until well after the damage was done.
Spyware sits on a device and collects. Keystrokes, files, saved passwords, email content, screenshots. Whatever it can reach, it can send back to whoever deployed it. The goal is not disruption. The goal is information.
Joint advisories from multiple national intelligence and cyber agencies are not routine. They happen when a threat has been assessed as significant enough to warrant coordinated public disclosure, and when the agencies involved believe that both the private sector and public institutions need to be on alert at the same time. The fact that the NCSC, FBI, and AIVD moved together on this one is itself meaningful information about how the threat has been evaluated at the highest levels.
Who Gets Targeted and Why Small Businesses Are Not Off the Hook
State-sponsored tools like CHOSEN BRICK are typically aimed at specific high-value targets. Government systems, critical national infrastructure, defence supply chains, research institutions with sensitive intellectual property. If your business has no connection to any of those, the likelihood of being directly targeted by the original operators is low.
But that framing misses something important.
Techniques developed by sophisticated state-sponsored groups have a consistent history of filtering into the wider criminal ecosystem within months. A targeted intelligence tool today becomes a widely available attack kit before the year is out. The timeline on this is well documented across years of post-incident analysis.
More immediately relevant: UK small businesses are increasingly embedded in supply chains that touch regulated and sensitive sectors. A small logistics firm moving goods for a defence-adjacent company. An accountancy practice handling payroll for a healthcare organisation. An IT support business managing systems for a local authority. In modern attacks, the path to the intended high-value target often runs directly through the smaller, less-defended business in the chain. You may not be the destination. You may still be the route in.
And separately from all of that, the controls that protect against CHOSEN BRICK are the same controls that protect against the criminal threats hitting UK SMEs every single week. The advisory is a useful prompt to check your own foundations.
Why Spyware Is Harder to Catch Than Most Business Owners Assume
A spyware infection on a single device can silently harvest login credentials for your business banking, your email platform, your payroll system, your client records. It can capture the moment a client emails you a copy of their passport or bank details. It can sit dormant for weeks or months while data is being collected, and by the time any visible sign appears, a significant volume of information may already have left your network.
That is why having genuine threat hunting and response capability matters. Waiting for something obvious to break before you look is not a viable approach for any business that handles data it has a duty to protect.
Five Practical Steps Worth Taking Right Now
- Keep every device patched and current. Spyware typically enters through known vulnerabilities in software that has not been updated. Removing those entry points consistently is one of the most effective things you can do. If your business cannot guarantee that reliably across every device, automated patch management handles it without depending on someone remembering to click update.
- Replace legacy antivirus with modern endpoint protection. Traditional antivirus matches files against a list of known threats. Sophisticated spyware is built specifically to evade that approach. Next-generation antivirus uses behavioural detection, identifying threats based on what they do rather than what they look like, which means it can catch things that have never been seen before.
- Apply DNS-level filtering across your network. Many spyware variants need to communicate outbound to a command server, to receive instructions and to exfiltrate what they have collected. DNS-level threat filtering can block those connections at the network layer, limiting what an attacker can actually do even if a device is already compromised.
- Remove unnecessary admin rights from day-to-day user accounts. Spyware running with standard user permissions can cause damage. Spyware that gains elevated privileges can cause significantly more. Restricting admin access to the accounts and tasks that genuinely require it limits the reach of anything that gets in.
- Think about how far a single compromised device can move. If an attacker lands on one machine, what can they reach from there? Reviewing your network segmentation and access controls limits the blast radius of any individual compromise before it becomes a business-wide problem.
What This Advisory Actually Tells You
You do not need to understand every technical detail of CHOSEN BRICK to respond sensibly to this advisory. Three intelligence services coordinating a public warning is a prompt to check your own foundations honestly: are your devices being patched consistently, are you running modern endpoint protection, do you have any visibility into what is happening on your network right now?
If the honest answer to any of those is uncertain, that is the thing to address first. The controls that protect a government department from state-sponsored spyware are the same controls that protect your business from the criminal threats that are running against UK SMEs every single week regardless of what is in the news.
If you want a straightforward conversation about where your current setup stands and what would close the gaps, get in touch with the team and we can work through it without the technical jargon.