Iranian Cyber Actors Deploy Chosen Brick Malware Against Global Dissidents

TEHRAN — Iranian state-sponsored cyber actors have launched a coordinated campaign using the CHOSEN BRICK malware to target dissidents, activists, and journalists across the globe, including in the United Kingdom, the United States, and the Netherlands. The offensive, identified on Sept. 15, aims to harvest sensitive communications to facilitate the tracking of individuals viewed as threats to the Iranian regime.

The campaign represents a significant escalation in digital surveillance efforts by Tehran against its critics abroad. Security researchers detected the malware infiltrating devices belonging to targets in Western nations who maintain ties to opposition groups or report on human rights abuses within Iran. The primary objective of the intrusion is the collection of contacts, email correspondence, and social media messages. By aggregating this data, Iranian intelligence services seek to map the movements of targeted individuals and identify their support networks.

CHOSEN BRICK, a sophisticated piece of spyware, operates by silently installing itself on compromised devices to exfiltrate data without the user's knowledge. Unlike previous iterations of Iranian cyber operations that focused primarily on domestic infrastructure or specific government entities, this campaign casts a wide net over civil society figures operating outside Iran's borders. The geographic scope includes major hubs for Iranian exile communities and international press organizations.

The timing of the attacks coincides with heightened political tensions surrounding the Iranian government's internal crackdown on dissent. Officials in the targeted nations have not yet issued public statements regarding specific incidents, though cybersecurity firms have flagged the activity as part of a broader pattern of state-sponsored espionage. The malware's ability to access encrypted messaging platforms and personal contact lists provides attackers with a detailed profile of their targets' social circles and daily routines.

Iranian authorities have historically denied involvement in cyberattacks against foreign nationals, often characterizing such operations as defensive measures or the work of non-state actors. However, the technical signatures associated with CHOSEN BRICK align with capabilities attributed to Iranian state entities in previous years. The campaign underscores a shift toward more aggressive extraterritorial surveillance tactics designed to suppress opposition activity regardless of physical location.

Questions remain regarding the full extent of the compromised devices and whether any data has already been transmitted back to Iranian command centers. Security experts are currently working to identify the specific infection vectors used in the attacks, which may involve phishing emails or compromised software updates. As the investigation unfolds, the potential for further intrusions into the digital lives of activists and journalists remains a pressing concern for human rights advocates and cybersecurity professionals alike.