# Iran-Linked Malware Uses Telegram to Spy on Dissidents Windows malware controlled via Telegram steals data from journalists and activists worldwide. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/ee98b193-fbf8-4767-b7fa-ef5ba6f2049f ## Multi-national cyber threat alert The FBI, UK's NCSC, and Netherlands' AIVD jointly disclosed a Windows malware campaign active since autumn 2023. Dubbed HEAVYGRAM (FBI) or CHOSEN BRICK (NCSC), this malware primarily targets Iranian dissidents, journalists, and activists globally. The operation is attributed to Iran's Ministry of Intelligence and Security (MOIS), with confirmed victims in the US, UK, and Netherlands. The malware's capabilities extend beyond data theft to include physical safety risks, as stolen information has appeared on pro-Iranian leak sites previously used to incite violence against targets. ## Telegram as command center The malware uniquely uses Telegram messaging app as its command-and-control channel. Each infected device connects to a dedicated Telegram bot, preventing cross-contamination between victims. Through these bots, attackers can remotely execute 12+ functions including screenshot capture, microphone activation, password theft, and file deletion. Recent versions employ proxy servers to conceal Telegram communications. While the malware doesn't self-propagate across networks, it can download additional tools through cloud services like Vultr and Storj. ## Sophisticated delivery methods Attackers initiate infections by impersonating trusted contacts or tech support, delivering malware disguised as legitimate software. Observed lures include fake versions of Pictory AI, KeePass, Norton Antivirus, and even MRI scan results. The malware employs a two-stage installation: first mimicking the expected application, then establishing the Telegram bot connection. To maintain persistence, it modifies Windows Registry Run keys and manipulates Microsoft Defender to exclude its files from scanning. ## Expanding target profile While initially focused on Iranian dissidents abroad, the FBI warns the malware could target anyone deemed of interest to Iranian authorities. The joint advisory reveals compromised devices have provided attackers with victims' contact networks, locations, and daily routines - information subsequently weaponized through leak sites. In March 2026, US authorities seized four such Iranian-operated sites that had hosted stolen data and threats against dissidents. ## Operational security concerns The malware demonstrates advanced evasion techniques, including dynamic file naming and folder structures that change between infections. This requires defenders to look beyond static indicators of compromise. The campaign represents a blending of cyberespionage with physical threats, as Iranian intelligence has previously used collected data to facilitate kidnappings and assassinations of targets abroad. The malware's Windows-exclusive nature currently limits its spread. ## Defensive recommendations Authorities advise heightened caution with unsolicited files, especially those requiring elevated privileges. Critical mitigation includes monitoring Windows Registry Run keys and checking Microsoft Defender exclusions. At-risk individuals should verify the integrity of common software downloads and consider isolating work/personal devices. The FBI's technical advisory provides specific file hashes and behavioral indicators, though warns these may evolve. Suspicious activity should be reported to national cybersecurity agencies. ## Platform accountability questions While Telegram claims to routinely remove malware-linked accounts, the persistent use of its platform for C2 raises questions about detection capabilities. The malware's proxy-obfuscated communications present new challenges for platform monitoring. This incident follows broader concerns about encrypted messaging apps being weaponized by state actors, with limited options for victims beyond endpoint protection measures. ## Geopolitical cyber conflict escalation This campaign reflects Iran's increasingly brazen use of cyber tools for transnational repression. The malware's sophistication and global reach demonstrate state-sponsored capabilities rivaling those of more advanced cyber powers. As Western agencies publicize these operations, it sets precedents for multinational responses to digital threats that blur traditional boundaries between cybercrime and state action. ## Sources covering this story - https://thehackernews.com/2026/09/iranian-hackers-use-telegram-controlled.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._