Western Intelligence Agencies Warn of Iranian Cyber Threats Targeting Dissidents

Western intelligence agencies have issued warnings regarding the use of Iranian spyware to target dissidents living in Western countries. The United States, the United Kingdom, and the Netherlands stated on Tuesday that Iran is 'almost certainly' conducting cyber operations against critics of its regime. The FBI, the UK's National Cyber Security Centre (NCSC), and the Netherlands’ AIVD intelligence service all provided coordinated advisories. Paul Chichester, director of the NCSC, noted that the cyber campaign demonstrates how Iran employs digital surveillance to suppress dissent, including stealing emails and messages and accessing devices. Chichester specifically mentioned a spyware family called 'CHOSEN BRICK,' which is reportedly used by Iranian state-linked cyber actors to extract sensitive information through spear-phishing campaigns on messaging platforms such as WhatsApp and Telegram. The FBI indicated that Iran’s Ministry of Intelligence and Security (MOIS) is utilizing this malware to gather intelligence, facilitate data leaks, and damage the reputations of targeted individuals. This warning continues a series of alerts from Western intelligence regarding Iran's attempts to target dissidents abroad. In March, the FBI had previously described MOIS's efforts to use the malware to collect data on targets, which was later shared online by an entity known as 'Handala Hack.' A related attack in March disrupted the global networks of Stryker, a major medical device company, with an Iran-linked hacking group claiming responsibility and stating it marked a new phase in cyber warfare. The Handala hackers also claimed to have accessed the personal emails of Kash Patel, the director of the FBI, and shared documents and photographs online. In July, US officials noted that a cyberattack on water systems in Minnesota bore similarities to the Handala Hack.