Iran Uses Telegram-Piloted Malware to Spy on Dissidents

Iran Uses Telegram-Piloted Malware to Spy on Dissidents

On 15 September the cyber agencies of three countries — the UK's NCSC, the US FBI, and the Netherlands' AIVD — jointly detailed a Windows malware family that Iran's Ministry of Intelligence and Security (MOIS) uses to surveil dissidents, journalists, and activists around the world (NCSC). The FBI calls it HEAVYGRAM; the NCSC calls it CHOSEN BRICK. Same malware, two names, one controller: a Telegram bot on the victim's own machine (The Hacker News).

The advisory is an update to the FBI's March 2026 alert — the first to describe this campaign — now carrying deeper technical detail and fresh indicators of compromise. The FBI dates the wider campaign to the autumn of 2023; CHOSEN BRICK has been observed hitting people in the UK, the US, and the Netherlands, and elsewhere, since at least 2025 (FBI/IC3).

Why this is spyware aimed at people, not networks

The victims are mostly Iranian dissidents, journalists opposed to Iran, activists, and members of groups whose views clash with the government — though the FBI warns anyone Iran decides it has an interest in could be targeted (The Hacker News). The advisory is blunt about what this cyber activity is for: Iran "almost certainly" uses it to support the repression of people it sees as a threat to the regime, and in some cases its intelligence services have plotted to kidnap or carry out lethal operations against individuals abroad (NCSC, The Record).

The real-world stakes are why this crosses from "interesting malware writeup" into a personal-safety issue. Screenshots and stolen contact lists let operators map a victim's routine. Personal details of some victims have appeared on pro-Iranian leak sites, increasing the risk to their safety — the US Justice Department seized four such sites in March 2026 after they were used to post stolen data and call for harm against dissidents (The Hacker News).

The attack chain: social engineering with a two-stage implant

The campaign is a textbook, carefully-researched social engineering operation. Operators contact the target on messaging apps like WhatsApp and Telegram, posing as a known contact or as platform technical support, and build rapport first — after researching the target extensively (MITRE T1589). They often start on the target's work device; if delivery fails or looks risky, they persuade the target to open the file on a personal device instead, outside the reach of corporate controls (NCSC).

The delivered file is disguised to match the pretext. Observed disguises include Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass — and, in at least one case, a fake MRI scan of a disk herniation (The Record). When opened, a convincing fake screen plays while the real payload installs in the background.

Stage 1  masquerading installer (Pictory / KeePass / Telegram / fake MRI)
          └─► shows a convincing decoy screen, drops stage 2
Stage 2  persistent implant (CHOSEN BRICK / HEAVYGRAM)
          └─► connects to api.telegram.org as a victim-specific Telegram bot
               → bidirectional C2, data exfiltration

Everything observed so far runs only on Windows. Stage 2 is persistent across reboots via a Windows registry Run key (values seen: SMQDService, winappx), and it adds Microsoft Defender exclusions to avoid being scanned. Each infected computer gets its own unique Telegram bot — an operational-security measure so a bounced victim cannot poison someone else's channel (FBI/IC3, The Hacker News).

What the implant can be told to do

Through the Telegram bot, the operators can task the malware with a wide range of functions: enumerate running processes and system information, capture screen content, enable the microphone for audio recording, copy Telegram and WhatsApp data from the browser, steal saved passwords and emails, download additional malware, and delete files. At least one version can also wipe the computer (The Hacker News, NCSC).

Exfiltration rides the Telegram bot plus commercial cloud object stores — VultrObjects, StorjShare, and Backblaze B2 — and recent variants tunnel their Telegram traffic through HTTPS/SOCKS5 proxies to hide it. That design is what makes the malware hard to spot: it talks to services that look like normal network traffic.

The agencies note the malware has not been observed spreading laterally on its own — but it can download more tools, so lateral movement is technically possible. CHOSEN BRICK has also been linked to the "Handala Hack" hack-and-leak persona (linked to Homeland Justice) behind a July 2025 operation that posted data it says it took from regime critics (FBI/IC3).

Indicators to hunt

The advisories list IOCs and warning signs, which the agencies stress can change as the malware evolves:

Registry Run values:   SMQDService  →  C:\ProgramData\SMQDServicePackages\...
                       winappx       →  C:\Users\All Users\MicrosoftDistribution\...
Dropper directory:     C:\Windows \SysWOW64      (note the space, non-standard)
Network domains:       api.telegram.org, vultrobjects.com, storjshare.io,
                       backblazeb2.com, iproyal.com, lightningproxies.net
Mutexes:               ytyjyujyu, noi672pp434awkc12f

If any of these show up in logs where they should not, investigate. The full file-hash list is in the advisory PDFs (NCSC).

What you should do

For individuals — especially journalists, activists, or diaspora members who could plausibly land on an MOIS list — the agencies' advice is practical: do not open files sent through messages or links; download software only from official websites or app stores; keep the OS and apps updated with automatic updates on; keep antivirus on and current; and take SmartScreen warnings seriously. If you suspect an infection, check the Run keys above, tell your IT support, and report to your national cyber agency.

For organizations, the defense stack is the usual but worth repeating: phishing-resistant multi-factor authentication, application allowlisting and managed-device controls, email scanning tools, and log monitoring for the indicators above. As with supply-chain backdoors we covered earlier, the payload is delivered through trusted channels and hides inside legitimate-looking traffic — so detection leans on monitoring the endpoints of the chain, not on catching a single "malicious" artifact.

One nuance the advisory does not settle: it does not say whether simply removing the malware clears the compromise. And Telegram, when asked about the March alert, said its moderators "routinely remove any accounts found to be involved with malware" (TechCrunch). The agencies present their conclusions as assessments, not courtroom findings.

The pattern here is a distinctly human one — nation-state threat actors running custom implants that blend into everyday infrastructure — and the lesson is layered. For the tech crew: Telegram-as-C2 is a reminder that "encrypted messaging" does not mean "trusted transport," and that cloud object stores are exfiltration infrastructure before they are convenience features. For everyone else along the target profile: your device is a surveillance target, the lure is tailored, and the advice starts with not opening unexpected files from people who sound official.

Sources

• UK National Cyber Security Centre: Advisory: Iranian Cyber Targeting of Dissidents, Activists and Journalists
• FBI / Internet Crime Complaint Center: FBI/IC3 Analysis: Government of Iran Cyber Actors Deploy Telegram C2 (IA-20260915)
• The Hacker News: Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists
• The Record / Recorded Future News: Iranian cyber spies used fake MRI scan results to hack 'enemy of regime'
• TechCrunch: FBI says Iranian hackers are using Telegram to steal data in malware attacks