Iran is disguising spyware as MRI scan results to trick regime critics around the world into downloading malicious files, Britain’s cyber agency has warned.
In a rare alert, GCHQ’s National Cyber Security Centre (NCSC) said online attackers working for the Iranian regime were adopting increasingly novel ways of attempting to dupe their targets into downloading malware to track them digitally.
Tehran’s spies have been caught posing as people known to their targets on WhatsApp and Telegram to “build rapport” before convincing them to download and open files that appear to be authentic.
The warning on fake MRI test results was issued jointly with intelligence services in the US and the Netherlands . They said that hostile actors had been “observed” using a spyware nicknamed “Chosen Brick”.
Once installed, the malware can collect sensitive information from targets, including their contacts, email and social media messages. It can also potentially eavesdrop on a target by tapping into the device’s microphone.
Some stolen personal details had appeared on pro-Iranian leak sites, exposing victims to further harassment, the NCSC said.
’Ruthless repression’
The NCSC, FBI and the Netherlands security service said they had issued the advisory to alert potential victims and help protect others at risk of being targeted.
Tehran’s targets include Iranian dissidents living overseas, journalists who report on the regime and others deemed to “pose a threat”.
Paul Chichester, the NCSC’s director of operations, said the details of the spy campaign “reveal how Iran ruthlessly uses digital surveillance in pursuit of its aim to repress critics of the regime, stealing emails and messages and accessing devices”.
He added: “With our international partners, we strongly encourage individuals at risk to familiarise themselves with the social-engineering techniques described in the advisory, and to act on the mitigation advice.
“We will continue to call out malicious cyber activity by the Iranian state and support communities with practical advice to strengthen their online personal security.”
The agencies described the Windows malware as “persistent”, meaning it can remain on a device even after it is rebooted.
Iran has previously been reported to use spyware to target dissidents. The FBI issued an alert weeks after the US conflict with Iran erupted in February this year.
However, Tuesday’s alert is Britain’s first major cyber warning since the war began, suggesting the agencies have detected a recent increase in activity.
In March, the NCSC said: “As a result of the ongoing conflict in the Middle East , there is likely no current significant change in the direct cyber threat from Iran to the UK. However, due to the fast-evolving nature of the conflict, this assessment may be subject to change.”
In the advisory, it said: “The NCSC assesses that Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime.”
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
