Iranian cyber targeting of dissidents, activists and journalists

September 15, 2026 · NCSC UK · Severity: HIGH

Advisory on CHOSEN BRICK malware, including technical analysis and advice to help individuals and organisations protect themselves.

Key Takeaways

Iranian state-sponsored cyber operations are increasingly targeting dissidents, activists, and journalists with sophisticated malware like CHOSEN BRICK for surveillance.
The technical advisory includes detailed malware analysis, network indicators, and behavioral detection techniques for identifying infected systems and preventing compromise.
Individuals at risk of Iranian cyber targeting should implement device segmentation, enable multi-factor authentication, and monitor for suspicious network activity.