Malware attacks on dissidents, journalists, etc. Screen capture and microphone access

Britain, the United States, and the Netherlands issued warnings about Iran-linked spyware attacks on the 15th (local time).

The UK's General Information and Communications Headquarters (GCHQ), in collaboration with the US Federal Bureau of Investigation (FBI) and the Netherlands Agency for Information Security (AIVD), issued an alert about the malware 'CHOSEN BRICK' and presented security guidelines.

“This malware allows Iranian government-linked cyber attackers to track the movements of targets including dissidents, activists, and journalists,” the organizations said in a statement.

Attackers appear to use sophisticated methods when approaching targets to plant malware. Impersonate an acquaintance or build a trust relationship with a target in a messaging app such as WhatsApp or Telegram. It is said that there were cases where they took advantage of common interests and even presented fake magnetic resonance imaging (MRI) test results.

Britain's GCHQ said, "Iran is almost certain to use cyber activities to suppress those it deems a threat to the regime," and pointed out, "There are also cases where Iranian intelligence agencies have plotted internationally to kidnap and kill individuals they identify as enemies of the regime."

“Together with our international partners, we strongly advise those at risk to be aware of this attack vector and take action to respond,” said Paul Chister, director of operations at GCHQ’s National Cyber ​​Security Center (NCSC).

Reuters reported that the Iranian Embassy in the UK did not immediately respond to this issue.