Iranian Hackers Deploy Telegram-Controlled Malware Against Dissidents

Cybersecurity agencies in the United States, the United Kingdom, and the Netherlands have released details about a Windows malware that they attribute to Iran's intelligence service. This malware is reportedly used to spy on dissidents, journalists, and activists worldwide. Controlled through the Telegram messaging app, it has the capability to copy emails and chat messages, take screenshots, and activate the microphone to record audio.

The FBI refers to this malware as HEAVYGRAM, while the U.K.'s National Cyber Security Center (NCSC) calls it CHOSEN BRICK. A joint advisory published on September 15 by the NCSC, the FBI, and the Netherlands' intelligence service, AIVD, provides an updated analysis of the malware, which expands on a previous alert from March 2026. This earlier alert was the first to describe the campaign and included new technical details and indicators of compromise.

According to the FBI, the malware is linked to Iran's Ministry of Intelligence and Security (MOIS), the primary intelligence agency in the country. The broader campaign associated with this malware dates back to the autumn of 2023. The advisory indicates that CHOSEN BRICK has been employed against individuals in the U.K., the U.S., and the Netherlands, as well as globally, since at least 2025.

The primary targets of this malware are Iranian dissidents, journalists critical of the Iranian government, activists, and members of groups whose views conflict with those of the regime. The advisory warns that anyone deemed of interest by Iran could potentially be targeted.

The risks associated with this malware extend beyond mere data theft. The information collected, including screenshots, can reveal a target's contacts, location, and daily routines. Some personal details of victims have surfaced on pro-Iranian leak sites, which raises concerns about their safety. In March, the U.S. Justice Department took action by seizing four Iranian leak sites that were reportedly used to disseminate stolen data and incite violence against dissidents and journalists.

The cyber activities conducted by Iran are likely aimed at suppressing perceived threats. In some instances, Iranian intelligence services have allegedly plotted to kidnap or assassinate individuals abroad.

The attack typically begins with a message from the attackers, who may impersonate someone familiar to the target or pose as tech support for a messaging application. This tactic is designed to build trust before delivering a file that appears to be a legitimate program.

Attackers often initiate their efforts on a target's work computer. If unsuccessful, they may attempt to compromise a personal device, which is less protected by company security measures. Reported disguises for the malware include well-known applications such as Pictory, KeePass, Telegram, RunwayML, Norton Antivirus, and Adobe Flash Player. In some cases, the malware was disguised as MRI scan results.

Mechanics of the Malware Installation Process

Upon opening the file, a convincing fake screen appears while the actual malware installs in the background. The malware operates in two stages: the first stage mimics the application, while the second connects the computer to a Telegram bot controlled by the attackers, allowing them to gather stolen data. Each version of the malware identified so far is designed to run exclusively on Windows.

To ensure persistence, the malware adds itself to a Windows registry "Run" key, enabling it to restart each time the user logs in. It also instructs Microsoft Defender to bypass certain folders to avoid detection.

Each infected computer is assigned a unique Telegram bot, which helps to keep the activities of different victims separate. Once activated, the malware can perform various functions, including listing running programs, taking screenshots, activating the microphone, copying data from Telegram and WhatsApp, stealing saved passwords and email addresses, downloading additional malware, and deleting files. At least one variant is capable of wiping the entire computer, according to the advisory.

While the malware has not been observed spreading autonomously across networks, it can download additional tools. Stolen files are transmitted via the Telegram bot and through cloud storage services like Vultr and Storj. Newer versions of the malware are reported to route their Telegram traffic through proxy servers to obfuscate their activity.

The advisory provides indicators that users and defenders can check for, including specific file hashes. However, the agencies caution that the malware's file names and folders may change, so these indicators should not be considered exhaustive.

Cleared for Release

To mitigate risks, the agencies recommend that individuals take certain precautions. They advise network administrators to implement security measures to protect against such threats. Anyone who suspects they may be infected should examine the "Run" key mentioned earlier, notify their IT support, and report the incident to their national cyber agency. The advisories do not clarify whether simply removing the malware would eliminate the compromise.

When the FBI first issued a warning about this campaign in March, Telegram informed TechCrunch that its moderators routinely remove accounts associated with malware. The agencies present their findings as assessments rather than definitive conclusions, highlighting the ongoing nature of the threat posed by this malware.