Actor Profile

Iranian state-sponsored cyber actors conducting surveillance operations against individuals perceived as threats to the Iranian regime. The NCSC assesses that Iran almost certainly uses cyber activity to support repression of dissidents, activists, and journalists globally, including in the UK. These actors are motivated by regime security objectives, seeking to monitor, intimidate, and suppress critics through digital surveillance. Attribution is provided by the UK NCSC, US FBI, and Netherlands AIVD.

TTPs (Tactics, Techniques, Procedures)

Primary TTPs include spear-phishing via messaging applications (WhatsApp, Telegram) with sophisticated social engineering. Actors impersonate trusted contacts, build rapport over time, and tailor lures to target interests—including fake MRI test results. Initial access leads to deployment of CHOSEN BRICK malware (Windows-only), which provides persistent access surviving reboots. Post-compromise capabilities include collection of contacts, emails, social media messages, screen captures, and microphone access. Exfiltrated data has appeared on pro-Iranian leak sites. Relevant MITRE ATT&CK techniques likely include T1566 (Phishing), T1204 (User Execution), T1056 (Input Capture), T1113 (Screen Capture), T1123 (Audio Capture), T1005 (Data from Local System), and T1547 (Boot or Logon Autostart Persistence).

Targets & Patterns

Targets include dissidents, activists, and journalists worldwide who are perceived as threats to the Iranian regime, with confirmed targeting in the UK. The actor employs highly personalized social engineering, researching target interests and professional contexts to craft convincing pretexts. This targeting pattern aligns with transnational repression objectives—using cyber surveillance to extend regime control beyond Iran's borders. Publication of victim data on leak sites suggests dual objectives: intelligence collection and intimidation through public exposure, potentially increasing physical risk to targeted individuals.

Historical Context

This campaign represents a continuation of Iran's documented use of cyber operations for transnational repression. The NCSC's assessment that Iran "almost certainly" uses cyber activity to repress perceived threats indicates an established pattern of behavior. The advisory follows previous NCSC reporting on Iranian state threats, including the April 2026 advisory on China-nexus compromised device networks, demonstrating ongoing international coordination to expose authoritarian state cyber operations. The appearance of victim data on pro-Iranian leak sites indicates integration with Iran's broader information operations infrastructure.

Defensive Recommendations

  • High-risk individuals should enroll in NCSC's dedicated support program for at-risk persons and free cyber defense services to receive tailored protective monitoring
  • Implement strict verification procedures for unsolicited contact via messaging apps (WhatsApp, Telegram)—independently confirm identity through known channels before engaging or clicking links
  • Deploy endpoint detection and response (EDR) solutions on Windows systems with behavioral monitoring for T1113 (screen capture), T1123 (audio capture), and T1547 (persistence mechanisms) associated with CHOSEN BRICK
  • Conduct security awareness training focused on advanced social engineering tactics, including rapport-building over extended periods and highly personalized lures tailored to professional or personal interests
  • Monitor for indicators of CHOSEN BRICK persistence mechanisms that survive reboots; consult FBI technical report (ic3.gov/CSA/2026/260915.pdf) for specific detection signatures and forensic artifacts

---

# Geopolitical Context

Geopolitical Context

The joint advisory on CHOSEN BRICK spyware reflects a coordinated Western response to what is assessed as an Iranian state-sponsored transnational repression campaign. The disclosure is consistent with a broader pattern of democratic states publicly attributing cyber operations linked to authoritarian regimes that target diaspora communities, activists, and journalists beyond their borders. Iran's use of digital surveillance tools to monitor and intimidate perceived threats to the regime represents an extension of domestic repression into the cyber domain, with global reach. The timing and multilateral nature of the disclosure—involving the UK NCSC, FBI, and Dutch AIVD—signals a strategic effort to impose reputational costs on Tehran while providing defensive guidance to vulnerable populations. This activity aligns with documented Iranian state behavior of leveraging cyber capabilities not only for espionage and influence operations, but also for social control and the suppression of dissent across international boundaries.

State Actor Alignment

The advisory explicitly attributes CHOSEN BRICK spyware operations to Iranian state actors, with the UK NCSC assessing that Iran "almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime." The UK government has stated that foreign attempts to intimidate, harass, or surveil individuals on British soil will not be tolerated, framing the disclosure within existing policy on transnational repression. While no new sanctions are announced in this advisory, the public attribution by three Western intelligence and security agencies represents a coordinated diplomatic and informational response. The disclosure appears designed to constrain Iranian operational freedom, warn potential targets, and establish a record of malign behavior that may inform future policy measures. The involvement of the FBI and Dutch AIVD suggests victims span multiple allied jurisdictions, reinforcing transatlantic coordination on countering Iranian cyber threats.

Business Impacty pro region

The global targeting of dissidents, activists, and journalists—including individuals in the UK—underscores the transnational dimension of Iranian digital repression and its implications for European security and human rights. European states hosting Iranian diaspora communities face ongoing challenges in protecting residents from foreign surveillance and intimidation, a concern that extends beyond cyber to physical security when personal details appear on pro-Iranian leak sites. The advisory's release may prompt other European nations to review their own exposure to similar campaigns and consider enhanced protective measures for at-risk populations. For the broader Middle East, the disclosure reinforces perceptions of Iran's willingness to employ cyber tools aggressively in pursuit of regime security objectives, potentially influencing regional threat assessments. The multilateral nature of the response also reflects deepening intelligence-sharing arrangements among Western allies on Iranian cyber activity, which may facilitate more coordinated defensive and diplomatic actions in the future.

Forecast

If Iranian state actors continue to prioritize transnational repression through cyber means, further public disclosures by Western governments are likely, particularly if targeting intensifies or expands to new victim categories. Should personal information of compromised individuals continue to surface on leak sites, the risk of physical harm to targets may increase, potentially prompting stronger diplomatic responses or protective measures by host governments. If the advisory's mitigation guidance is widely adopted by at-risk communities, Iranian operators may shift tactics—potentially moving toward mobile platforms, exploiting zero-day vulnerabilities, or refining social engineering techniques to evade detection. Conversely, if Western states escalate responses to include sanctions on entities linked to these operations, Iran may recalibrate the risk-reward calculus of such campaigns, though historical patterns suggest regime security priorities will likely sustain surveillance efforts against perceived threats regardless of external pressure.