Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists — [https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZTZstgI7jZ
What’s new: Cybersecurity agencies in the U.S., U.K., and Netherlands have reported that Iranian hackers are using Windows malware, referred to as HEAVYGRAM by the FBI and CHOSEN BRICK by the NCSC, to spy on dissidents, journalists, and activists. The malware is controlled via the Telegram messaging app and can steal emails, chat messages, take screenshots, and activate microphones. The campaign has been active since at least 2025, targeting individuals globally, particularly those opposing the Iranian government.
Who’s affected
Targets include Iranian dissidents, journalists, and activists in the U.S., U.K., Netherlands, and worldwide. The malware poses a risk to anyone deemed of interest by Iranian intelligence services.
What to do
- Do not open files sent through messages or links; download software only from official sources.
- Keep operating systems and applications updated with automatic updates enabled.
- Run current antivirus software and do not disable it.
- Do not ignore SmartScreen warnings when downloading files.
- Network administrators should enable phishing-resistant multi-factor authentication and use application allowlisting.
- Monitor network traffic for suspicious connections and check logs for indicators of compromise.
