Iran-Linked Malware Uses Telegram to Spy on Dissidents
Windows malware controlled via Telegram steals data from journalists and activists worldwide.
1Multi-national cyber threat alert
The FBI, UK's NCSC, and Netherlands' AIVD jointly disclosed a Windows malware campaign active since autumn 2023. Dubbed HEAVYGRAM (FBI) or CHOSEN BRICK (NCSC), this malware primarily targets Iranian dissidents, journalists, and activists globally. The operation is attributed to Iran's Ministry of Intelligence and Security (MOIS), with confirmed victims in the US, UK, and Netherlands. The malware's capabilities extend beyond data theft to include physical safety risks, as stolen information has appeared on pro-Iranian leak sites previously used to incite violence against targets.
2Telegram as command center
The malware uniquely uses Telegram messaging app as its command-and-control channel. Each infected device connects to a dedicated Telegram bot, preventing cross-contamination between victims. Through these bots, attackers can remotely execute 12+ functions including screenshot capture, microphone activation, password theft, and file deletion. Recent versions employ proxy servers to conceal Telegram communications. While the malware doesn't self-propagate across networks, it can download additional tools through cloud services like Vultr and Storj.
3Sophisticated delivery methods
Attackers initiate infections by impersonating trusted contacts or tech support, delivering malware disguised as legitimate software. Observed lures include fake versions of Pictory AI, KeePass, Norton Antivirus, and even MRI scan results. The malware employs a two-stage installation: first mimicking the expected application, then establishing the Telegram bot connection. To maintain persistence, it modifies Windows Registry Run keys and manipulates Microsoft Defender to exclude its files from scanning.
4Expanding target profile
While initially focused on Iranian dissidents abroad, the FBI warns the malware could target anyone deemed of interest to Iranian authorities. The joint advisory reveals compromised devices have provided attackers with victims' contact networks, locations, and daily routines - information subsequently weaponized through leak sites. In March 2026, US authorities seized four such Iranian-operated sites that had hosted stolen data and threats against dissidents.
5Operational security concerns
The malware demonstrates advanced evasion techniques, including dynamic file naming and folder structures that change between infections. This requires defenders to look beyond static indicators of compromise. The campaign represents a blending of cyberespionage with physical threats, as Iranian intelligence has previously used collected data to facilitate kidnappings and assassinations of targets abroad. The malware's Windows-exclusive nature currently limits its spread.
6Defensive recommendations
Authorities advise heightened caution with unsolicited files, especially those requiring elevated privileges. Critical mitigation includes monitoring Windows Registry Run keys and checking Microsoft Defender exclusions. At-risk individuals should verify the integrity of common software downloads and consider isolating work/personal devices. The FBI's technical advisory provides specific file hashes and behavioral indicators, though warns these may evolve. Suspicious activity should be reported to national cybersecurity agencies.
7Platform accountability questions
While Telegram claims to routinely remove malware-linked accounts, the persistent use of its platform for C2 raises questions about detection capabilities. The malware's proxy-obfuscated communications present new challenges for platform monitoring. This incident follows broader concerns about encrypted messaging apps being weaponized by state actors, with limited options for victims beyond endpoint protection measures.
8Geopolitical cyber conflict escalation
This campaign reflects Iran's increasingly brazen use of cyber tools for transnational repression. The malware's sophistication and global reach demonstrate state-sponsored capabilities rivaling those of more advanced cyber powers. As Western agencies publicize these operations, it sets precedents for multinational responses to digital threats that blur traditional boundaries between cybercrime and state action.
Original article: The Hacker News — Iran-Linked Malware Uses Telegram to Spy on Dissidents