Allied agencies detail Iran-attributed spyware infections targeting dissidents and journalists

Cybersecurity agencies in the United Kingdom, United States and Netherlands have published coordinated findings on spyware used against dissidents, activists, journalists and other people perceived as opponents of the Iranian state.

The 15 September disclosure substantially expands the public record of the campaign. The UK National Cyber Security Centre has documented a malware family it calls CHOSEN BRICK, while a new FBI report provides detailed analysis of seven samples it tracks as HEAVYGRAM. The Dutch General Intelligence and Security Service, the AIVD, also confirmed that victims in the Netherlands had been informed.

Authorities have not disclosed how many people were infected or identified individual victims. Their reporting nevertheless establishes successful infections and confirmed exfiltration from compromised devices. The findings therefore document operational spyware deployment, not capability alone.

Personal targeting leads to Windows infections

The campaign begins with extensive research into prospective victims and tailored approaches through messaging or social-media services. Operators develop a plausible pretext, build rapport and attempt to persuade the target to run disguised Windows software. In some cases investigated by the FBI, victims instead supplied remote-access details.

The infection path therefore depends on social engineering and action by the target. None of the agencies identified a zero-click technique, a CVE or an exploited vulnerability in Windows or any communication service used during the campaign. Applications and brands appearing in approaches, lures or infrastructure should not be treated as vulnerable on that basis.

All CHOSEN BRICK instances observed by the NCSC targeted Windows, and the files analysed by the FBI were Windows executables. Neither agency specified affected Windows releases or editions, however, and neither declared other operating systems unaffected.

The targeting can also cross the boundary between work and private technology. Employers may protect corporate accounts and managed endpoints, but high-risk staff can still face approaches directed at personal messaging accounts and personal Windows devices. The agencies consequently advise organisations supporting people at elevated risk to consider both environments when assessing possible exposure.

Surveillance extends beyond stolen files

Once installed, the malware can establish persistence across reboots and attempt to weaken Microsoft Defender protections. Authorities say it uses Telegram bots for command and control, can deliver additional payloads and sends collected information through Telegram and cloud object-storage services. The NCSC found that some newer variants used proxy services to obscure Telegram traffic.

Investigators documented collection involving files, emails, system information, screenshots and audio, as well as Telegram and WhatsApp information held in browsers. Screen capture was commonly observed in infections, while files and other collected material were exfiltrated. Persistence and attempted weakening of endpoint protection can allow that access to continue after a device restarts.

The consequences can extend into a target’s physical life. Contacts, location details and patterns of activity may expose associates and increase surveillance and personal-safety risks. The NCSC said personal information taken from some previous victims later appeared on pro-Iranian leak sites, increasing the potential for harassment and reputational harm alongside intelligence collection.

The agencies also set boundaries around what they observed. The NCSC has not seen automated lateral movement from an infected machine. It found file-deletion or system-wiping functionality in at least one sample, but did not report that operators had used those destructive capabilities against victims. No broad disruption to an organisation has been disclosed.

Different names and timelines remain unresolved

The joint assessment attributes CHOSEN BRICK activity to Iranian state cyber actors. The NCSC separately assesses that Iran almost certainly uses cyber operations to support repression of dissidents, activists, journalists and others regarded as threats to the regime. The FBI makes the narrower assessment that Iranian actors use HEAVYGRAM on behalf of Iran’s Ministry of Intelligence and Security.

The agencies do not formally state that CHOSEN BRICK and HEAVYGRAM are exact aliases. The NCSC presents the FBI publication as further technical analysis connected to the malware, but the public reports leave open whether the two names cover identical malware, overlapping activity or different analytical scopes.

Their timelines also differ. The FBI says actors have used HEAVYGRAM since autumn 2023, without giving an exact first-use date. The NCSC says it has observed CHOSEN BRICK targeting people globally, including in the UK, US and Netherlands, from at least 2025. Those dates reflect each agency’s reporting and should not be combined into a single claimed start date.

The September FBI publication updates FLASH-20260320-001, issued on 20 March 2026, with substantially more malware analysis and additional indicators. That earlier FBI report assessed that some information posted by Handala Hack during a July 2025 hack-and-leak operation had been acquired through the malware campaign, and connected Handala Hack with Homeland Justice and MOIS actors. The reviewed material does not independently verify that assessment.

The Handala Hack and Homeland Justice associations were not repeated in the September joint advisory or updated FBI report, so they cannot be extended to every operation involving CHOSEN BRICK or HEAVYGRAM. The public reporting also does not identify individual operators or reveal the intelligence underpinning the FBI’s precise MOIS attribution.

Defence depends on disrupting the approach

There is no campaign-specific patch or fixed software version because authorities have not identified an exploited product flaw. Updating operating systems and applications remains recommended as general hardening, preferably through automatic updates, but it does not replace scrutiny of software delivered through messages.

High-risk users should avoid installing applications received through attachments or links and instead obtain software directly from legitimate vendor sites or official app stores. The agencies also recommend keeping reputable antivirus or anti-malware protection enabled and current, paying attention to Microsoft SmartScreen warnings, using strong unique passwords and enabling phishing-resistant multi-factor authentication where available.

Employers can reinforce those measures through application allowlisting, suitable endpoint policies, email security controls and endpoint and network monitoring. Defenders should search available logs and systems for the indicators and detection signatures published by the NCSC and FBI. Anyone who suspects compromise should contact an IT or incident-response provider and report the incident to the appropriate national authority or law-enforcement service.

The campaign may be relevant to journalists, activists, Iranian diaspora organisations, universities, non-governmental organisations and employers supporting people at risk of transnational repression in Australia. However, the reviewed official reporting identifies no Australian victim, Australia-specific infrastructure or Australian government co-signature, and provides no evidence that Australian targets have been affected.

When official reporting describes tailored persuasion while identifying no exploited product flaw, separating social engineering from software vulnerability sharpens risk assessment. Carry that analytical distinction into structured learning with The Hack Academy’s online cybersecurity training programme, which combines self-paced learning and practical exercises with theory in cybersecurity fundamentals and internet vulnerabilities.

Photo Credit: DepositPhotos.com