The National Cyber Security Centre of the United Kingdom (NCSC), in coordination with the Federal Bureau of Investigation of the United States (FBI) and the intelligence service of the Netherlands, has launched a joint warning about a digital surveillance operation attributed to actors related to Iran and aimed at dissidents, activists, and journalists.
According to a statement released this Tuesday by the NCSC, those responsible for the campaign use spyware called 'Chosen Brick' to obtain conversation histories, contact agendas, and emails, as well as to take screenshots and activate the microphone of compromised devices.
The 'modus operandi' described by the authorities consists of attackers initially contacting their potential victims through various instant messaging applications, impersonating the identity of acquaintances or employees, with the aim of getting the person to download malicious files on Windows operating system devices, where the program remains operational even after restarting the computer.
"The details of this cyber campaign reveal how Iran ruthlessly uses digital surveillance in order to repress critics of the regime, stealing emails, messages, and accessing their devices," said the operations director of the NCSC, Paul Chichester.
The stolen information is subsequently disseminated on websites affiliated with Tehran, which, according to the intelligence services of the United Kingdom, the United States, and the Netherlands, "potentially increases the risk to the personal security of those affected."