The United States, the United Kingdom, and the Netherlands have warned that Iranian spyware is being used to target dissidents living in Western countries.
Intelligence agencies from these three nations cautioned on Tuesday that Iran is "almost certainly" employing cyber operations against Iranian critics of the regime.
In coordinated advisories, the FBI in the US, Britain’s National Cyber Security Centre (NCSC), and the Netherlands’ AIVD intelligence service issued the same warning.
"The details of this cyber campaign reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices," said Paul Chichester, the director of Britain’s NCSC.
Chichester highlighted a spyware family known as “CHOSEN BRICK” that is allegedly used by Iranian state-linked cyber actors to steal sensitive information through “spear-phishing” campaigns on messaging platforms including WhatsApp and Telegram.
The FBI stated that Iran’s Ministry of Intelligence and Security (MOIS) is using the malware to “collect intelligence, conduct data leaks, and inflict reputational harm against their intended targets”.
This advisory continues a pattern of regular warnings from Western intelligence agencies regarding Iran's efforts to target dissidents abroad.
In a warning issued in March, the FBI described alleged MOIS efforts to use the malware to collect data on targets, which was then posted online by a persona known as “Handala Hack.”
That attack in March crippled the global networks of Stryker, one of the world’s largest medical device companies, with an Iran-linked hacking group claiming responsibility and warning it marked “the beginning of a new chapter in cyber warfare.”
The so-called Handala hackers also claimed to have gained access to the personal emails of Kash Patel, the director of the US Federal Bureau of Investigation (FBI), sharing photographs and documents from the official online.
In July, US officials indicated that a cyberattack on water systems in the state of Minnesota bore similarities to the “Handala Hack.”
