US, UK, Netherlands Detail Iranian Malware Campaign Targeting Global Dissidents

WASHINGTON (Sept. 15) — Cybersecurity agencies in the United States, United Kingdom, and the Netherlands detailed a sophisticated malware campaign attributed to Iran's Ministry of Intelligence and Security (MOIS), revealing a coordinated effort to spy on journalists, activists, and political dissidents worldwide. The joint disclosure highlights the use of custom Windows-based software controlled via the Telegram messaging platform to infiltrate devices and extract sensitive data from targets operating outside Iranian borders.

The operation, which has been active across multiple continents, marks a significant escalation in state-sponsored cyber espionage aimed at suppressing opposition voices. Security officials stated that the malware is designed to evade detection by standard antivirus measures, allowing operators to maintain persistent access to compromised systems. Once installed, the software grants intelligence officers the ability to monitor communications, access files, and activate microphones and cameras on infected devices.

The campaign specifically targets individuals Iran considers a threat to its regime, including human rights defenders and members of the diaspora community. By leveraging Telegram as a command-and-control channel, Iranian operators can issue instructions to the malware in real time, updating its capabilities or directing it to specific targets without relying on traditional infrastructure that is easier to trace.

Cybersecurity experts from the three nations emphasized the global reach of the intrusion, noting that victims have been identified in North America, Europe, and other regions. The disclosure serves as a warning to potential targets and outlines technical indicators to help organizations identify and neutralize the threat. Authorities urged individuals who believe they may be targeted to update their operating systems, avoid suspicious links, and employ advanced endpoint protection tools.

Iran has not publicly commented on the specific allegations regarding the malware's deployment or its attribution to the MOIS. The ministry has historically denied engaging in cyberattacks against foreign entities, often characterizing such accusations as attempts to undermine national security efforts. However, the technical details provided by Western agencies suggest a high level of sophistication and state backing consistent with known Iranian cyber operations.

The revelation raises questions about the full scope of the campaign and whether other nations or organizations have been compromised using similar methods. Security researchers are currently analyzing the malware's code to determine if it contains additional capabilities beyond surveillance, such as data exfiltration or system sabotage. As investigations continue, international partners are expected to share further technical indicators to bolster global defenses against this evolving threat.

The coordinated response underscores a growing trend of multilateral cooperation in addressing state-sponsored cyber aggression. With the digital landscape becoming increasingly hostile for activists and journalists, the ability of intelligence agencies to detect and attribute these attacks remains critical to protecting free expression and human rights globally.