UK, US and Netherlands issue advisory on Iran spyware

Iran has been accused of utilizing spyware to monitor dissidents, activists, and journalists overseas, according to the UK, US, and the Netherlands. The UK's National Cyber Security Centre revealed that the cyber actors employed a spyware family called Chosen Brick to obtain sensitive data such as emails, messages, and device information through spear-phishing campaigns.

Paul Chichester, NCSC Director of Operations, stated that the campaign demonstrates Iran's "ruthless use of digital surveillance" in an effort to suppress critics of the regime. The malware is capable of gathering information from contact lists, emails and social media accounts, capturing screen content, and accessing microphones.

Some victims' personal details have since been posted on pro-Iranian leak sites. Attackers often impersonated trusted contacts on messaging apps and customized their approach to individual targets, even using fabricated documents and fake medical records to persuade victims to download the malware. The NCSC, along with the FBI and the Netherlands' AIVD intelligence service, stated that Iran "almost certainly" employs cyber operations to suppress individuals they consider threats.

In 2022, the UK, US, and France joined over a dozen other countries in condemning a rise in assassination, kidnapping, and harassment plots by Iranian intelligence services against people in Europe and North America.