UK, US and Netherlands issue advisory on Iran spyware

Iran's government is accused of utilizing spyware to surveil dissidents, activists, and journalists communicating on platforms such as WhatsApp and Telegram, according to reports from the UK, US, and the Netherlands. The UK's National Cyber Security Centre disclosed that the malicious actors employed a spyware family called Chosen Brick to pilfer emails, messages, and other confidential data via spear-phishing campaigns.

Paul Chichester, Director of Operations at the NCSC, highlighted the government's use of digital surveillance to "repress critics of the regime" and gather sensitive information from devices. The malware can harvest data from contact lists, emails, social media accounts, capture screen content, and gain access to microphones. Some victims' personal details later surfaced on pro-Iranian leak sites, as noted by the NCSC.

Attackers frequently impersonated trusted contacts on messaging apps and customized their tactics for individual targets, sometimes using fabricated documents and fabricated medical test results to entice victims to download the malware. The NCSC, in collaboration with the FBI and the Netherlands' AIVD intelligence service, stated that Iran "almost certainly" utilizes cyber operations to suppress those deemed threats.

In 2023, the UK, US, and France joined a coalition of over a dozen nations condemning a surge in assassination, kidnapping, and harassment plots orchestrated by Iranian intelligence services against individuals in Europe and North America. The countries expressed their unity in opposing these acts, which they deemed a clear violation of sovereignty.

The UK government recently revealed that it had thwarted more than 20 Iran-linked plots aimed at kidnapping or killing people in the UK since 2022, including British citizens and others Tehran considers threats.