Security Minister Dan Jarvis has warned that Iran’s targeting of critics through cyber attacks poses a serious threat, after British, American and Dutch security agencies exposed spyware used against dissidents, activists and journalists.
The National Cyber Security Centre, working with the FBI and the Netherlands’ intelligence service AIVD, has published new guidance detailing a malware family known as CHOSEN BRICK, which it says has been used by Iranian state-linked cyber actors against individuals around the world, including in the UK.
Jarvis said:
“The Iranian regime’s targeting of its critics through cyber attacks presents a serious threat.”
He added:
“With our international partners, we stand firm in defence of our democratic values, free media, and free speech.”
Spyware used against dissidents and journalists
According to the NCSC, CHOSEN BRICK has been used since at least 2025 to collect sensitive information from targeted devices.
The malware can obtain material including contacts, emails, social media messages, screen captures and messaging history — information that security agencies warn could be used to monitor individuals and track their movements.
Those targeted have included dissidents, activists and journalists regarded by the Iranian authorities as opponents of the regime.
The NCSC said the new advisory is designed to help individuals and organisations most at risk identify malicious activity and strengthen their defences.
Britain working with US and Netherlands
The warning was issued jointly by British, American and Dutch authorities, reflecting the international nature of the operation.
The three countries say Iranian state-linked actors have used spear-phishing and spyware to target critics beyond Iran’s borders. The FBI has published further technical analysis of the malware.
Jarvis welcomed the coordinated response and said expert advice from the NCSC would help people at risk protect themselves.
The intervention also underlines the growing importance of international intelligence cooperation in tackling hostile-state cyber activity.
Iran already identified as major cyber threat
British security officials have repeatedly warned that Iran is among the states using cyber operations to pursue political and intelligence objectives overseas.
Earlier this year, the NCSC said Iran was “almost certainly” using cyber activity to support the repression of British-based individuals considered threatening by the Iranian regime.
The agency has also previously warned UK organisations to remain alert to Iran-linked cyber activity, particularly amid heightened tensions in the Middle East.
Protecting free speech and democratic values
For Jarvis, the issue goes beyond cybersecurity alone.
Targeting journalists, campaigners and political dissidents abroad can amount to an attempt by authoritarian governments to extend repression beyond their own borders and intimidate critics living in democratic countries.
That is why, he argues, Britain must combine stronger cyber defences with a clear political response.
Jarvis’ message is that hostile regimes should not be allowed to use technology to silence critics overseas — and that Britain will work with its allies to expose such activity, protect those at risk and defend free media, free speech and democratic values.
