12OCT

UK, US and Dutch expose Iranian spyware

2 min read

10:55UTC

The NCSC, the FBI and the Dutch AIVD exposed CHOSEN BRICK, Windows spyware Iranian state actors plant on dissidents after befriending them on WhatsApp and Telegram.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

Iranian operators befriend targets on WhatsApp and Telegram before sending the CHOSEN BRICK spyware.

The National Cyber Security Centre (NCSC) in London, the US Federal Bureau of Investigation (FBI) and the Dutch General Intelligence and Security Service (AIVD) exposed CHOSEN BRICK on 15 September⁠¹. The agencies say Iranian state actors use the Windows spyware against dissidents, activists and journalists, including in the UK.

The operators pose as contacts on WhatsApp and Telegram, build a relationship over time, and then send tailored lures such as fake magnetic resonance imaging (MRI) scan results. Once installed, the spyware takes contacts, email and messages, captures the screen and can switch on the microphone. The NCSC and AIVD had warned in March that Iran's Islamic Revolutionary Guard Corps was among state actors posing as contacts to take over messaging accounts.

Stolen material has appeared on pro-Iranian leak sites⁠². The NCSC says that exposure may put victims' physical safety at risk, which moves the harm beyond the data itself to the people named in it.

Deep Analysis

In plain English

Iran's government watches and tries to silence critics, including those who live abroad. Britain's national cyber agency, the NCSC, the American FBI and the Dutch intelligence service AIVD have named a piece of spying software, called CHOSEN BRICK, that Iranian state hackers use against them. The hackers pretend to be friends or contacts on WhatsApp or Telegram and chat for a while to build trust. Then they send a file made for that person, such as fake hospital scan results, that installs the spyware on a Windows computer. The software can copy messages and contacts, record the screen and switch on the microphone. Some stolen material has been posted online.

Deep Analysis

Root Causes

Iranian exiles keep family, activist and media contacts on a handful of messaging apps. A stranger who builds a relationship there over weeks faces none of the filters that guard corporate email.

Tailored lures such as fake MRI results exploit personal circumstances the operators have learned in conversation. Generic security training cannot anticipate a lure built for one person.

The regime treats diaspora journalists and activists as domestic threats, so it applies its internal security apparatus to people living in the UK and elsewhere.

What could happen next?

Risk
Contacts and sources of each victim are exposed too, so one infected laptop can reveal a whole network of dissidents.
Precedent
A UK-led attribution framed around transnational repression strengthens the case for the protections peers sought in the Cyber Security and Resilience Bill.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: Ruhollah Zam, a dissident journalist living in France, was lured to Iraq in October 2019 through contacts he trusted, seized and taken to Iran, then executed in December 2020. Rapport-led targeting of exiles has ended in physical harm before, which is the risk the NCSC now flags.

Counter-parallel: In November 2021 the US added Israel's NSO Group to its trade blacklist and Apple sued it over Pegasus spyware used against dissidents. Commercial spyware can be squeezed through export controls and courts; CHOSEN BRICK is a state-built tool outside both levers.

Consensus view: The NCSC assesses that Iran 'almost certainly' uses cyber operations to support repression of perceived threats to the regime, and its Director of Operations, Paul Chichester, fronted the release. Publishing stolen material on pro-Iranian leak sites turns espionage into intimidation, which is why the NCSC warns of risk to victims' physical safety rather than only their data.

Counter-view: Tehran has consistently rejected Western attributions of state hacking as politically motivated, and no Iranian response to this advisory was found. The choice of Windows spyware is also odd for a diaspora that lives on WhatsApp and Telegram on phones, which suggests the operators target the family or work PC as the store of contacts and documents.

Key tension: Whether exposure helps targets more than it warns the operators, who can rename the tool and keep the rapport method, as the March NCSC and AIVD warnings already showed.

Sources:NCSC

Mentions:AIVD →NCSC →FBI →CHOSEN BRICK →WhatsApp →Telegram →Iran →United Kingdom →Apple →Tehran →Iraq →London →France →Israel →Islamic Revolutionary Guard Corps (IRGC) →Paul Chichester →NSO Group →Pegasus spyware →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

NCSC· 12 Oct 2026

Read original →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.