Western intelligence warns of Iranian cyber threats targeting dissidents

The intelligence services of the United States, the United Kingdom and the Netherlands issued a joint warning that Iranian state-linked cyber operations are being used to target critics of the Iranian government living in Western countries. The FBI, Britain’s NCSC and the Netherlands’ AIVD released coordinated advisories saying the campaign is "almost certainly" aimed at collecting information on opponents of the regime.

Britain’s NCSC director Paul Chichester pointed to a spyware family known as CHOSEN BRICK, which is reportedly deployed to exfiltrate sensitive information. According to the advisory, these tools have been used in spear-phishing campaigns delivered via messaging platforms such as WhatsApp and Telegram to steal emails and messages and to gain access to devices.

The FBI said the Iranian Ministry of Intelligence and Security has used the malware to gather intelligence, publish data leaks and inflict reputational harm on intended targets. The recent bulletin follows earlier warnings: in March the FBI described alleged MOIS activity that collected data later posted online by a persona called 'Handala Hack.' That March incident was also linked to an attack that disrupted the global networks of medical device maker Stryker, with an Iran-linked group claiming responsibility.

U.S. officials have continued to connect similar events to the same actors; the Handala persona has claimed to have published material taken from personal accounts, and in July a cyberattack on water systems in Minnesota was said to resemble the Handala operation. The agencies’ joint advisories emphasize a recurring pattern of surveillance and disruptive cyber activity directed at critics and organizations outside Iran.