British spies uncover Iranian cyber attacks targeting dissidents, journalists

British intelligence has uncovered an international cyber espionage campaign orchestrated by Iranian state actors targeting dissidents, activists and journalists worldwide.

According to findings from the UK’s National Cyber Security Centre (NCSC), alongside the US Federal Bureau of Investigation (FBI) and the Netherlands’ AIVD intelligence service, the operation relies on advanced spyware designed to harvest sensitive data and monitor targets.

The cyber threat operation relies heavily on social engineering via messaging platforms including WhatsApp and Telegram. Attackers build rapport with targets before tricking them into downloading malicious files disguised as legitimate software, such as developer tools and antivirus applications, or fabricated documents such as fake MRI test results.

Once installed on Windows devices, the spyware – called Chosen Brick – establishes persistence using system registry keys and actively adds exclusions to Microsoft Defender antivirus to evade detection.

Chosen Brick utilises Telegram bots for command and control, granting hackers extensive capabilities to compromise targets. The malware can capture screen content, record audio via device microphones, extract browser-cached messaging data and steal email content and contacts.

Highlighting the severe political motives behind these breaches, the NCSC states that “Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists”.

Furthermore, the FBI warned that the nation’s Ministry of Intelligence and Security (MOIS) uses the malware to “collect intelligence, conduct data leaks, and inflict reputational harm against their intended targets”.

International authorities have noted that stolen personal details from previous victims have frequently appeared on pro-Iranian leak sites, significantly increasing physical safety risks. To combat these threats, security agencies recommend that individuals avoid downloading unsolicited attachments, maintain automatic software updates and report suspicious communications immediately.

NCSC