Western agencies warn Iranian spyware is targeting dissidents

The United States, the United Kingdom and the Netherlands warned on Tuesday that Iranian cyber operations are being used to target dissidents and other critics of Iran living in the West. The coordinated warning identified a spyware family known as CHOSEN BRICK.

The FBI, Britain’s National Cyber Security Centre and the Netherlands’ AIVD intelligence service said Iran is “almost certainly” using cyber operations against critics of its government. The agencies said the activity can involve stealing emails and messages and accessing devices.

How CHOSEN BRICK is used

Britain’s NCSC director Paul Chichester said Iranian state-linked cyber actors allegedly use CHOSEN BRICK in spear-phishing campaigns on messaging platforms including WhatsApp and Telegram to obtain sensitive information.

The FBI said Iran’s Ministry of Intelligence and Security uses the malware to collect intelligence, conduct data leaks and inflict reputational harm on intended targets. Read the context: Al-Sharaa’s government reshuffles Syria’s security and intelligence leadership.

A continuation of warnings about attacks abroad

The agencies’ advice continues regular Western intelligence warnings about alleged Iranian efforts to target dissidents outside Iran. In March, the FBI described alleged MOIS efforts to collect information using the malware and said material was later posted online by a persona known as “Handala Hack.”

The supplied account also links the group to claims involving Stryker’s global networks, the personal emails of FBI Director Kash Patel and a July cyberattack on water systems in Minnesota. US officials said the Minnesota incident resembled the “Handala Hack.”