As reported by The Hacker News, a joint advisory from the FBI, the U.K.'s NCSC, and the Netherlands' AIVD has detailed a long-running Iranian cyber-espionage campaign using Windows malware controlled through Telegram to surveil dissidents, journalists, and activists worldwide. The FBI labels the tooling HEAVYGRAM; the NCSC calls it CHOSEN BRICK. Attribution runs to Iran's Ministry of Intelligence and Security (MOIS), with activity dating back to at least autumn 2023.

Threat Intelligence: As reported by The Hacker News, a joint advisory from the FBI, the U.K.'s NCSC, and the Netherlands' AIVD has detailed a long-running Iranian cyber-espionage campaign using Windows malware controlled through Telegram to surveil dissidents, journalists, and activists worldwide.

Why Telegram-as-C2 Is the Real Story

The technical novelty here isn't the payload's capabilities — screen capture, email and chat exfiltration, microphone activation are all standard commodity RAT behaviors. The standout is the command-and-control architecture. By routing instructions through Telegram, operators inherit a globally trusted, encrypted, high-availability messaging backbone that most networks permit by default. Traditional C2 detections that flag unknown domains, suspicious IPs, or low-reputation hosting now miss the traffic entirely because it terminates on Telegram's legitimate infrastructure.

This is the same class of abuse we've seen with Discord, Slack, and Google Drive as C2 relays — but Telegram's combination of bot API programmability, channel persistence, and broad network allowlisting makes it particularly attractive to state-sponsored groups who need their traffic to look ordinary in a target's region.

The Work-to-Personal Pivot Deserves More Attention

The advisory notes that attackers often attempt initial compromise on a target's work machine and, when that fails, pivot to the personal device. This is tactically significant and under-discussed. Corporate endpoints typically run EDR, application allowlisting, and web filtering — all of which raise the cost of a successful dropper execution. A journalist's personal laptop or phone often has none of that, and the attacker exploits the asymmetry.

For defenders, this reframes the threat model. The at-risk population isn't just the user on their work laptop. It's the user as a whole person whose personal device may be the easier path to the same exfiltration goals — contacts, calendar, location, voice recordings — that MOIS ultimately wants.

Physical Safety Elevates the Stakes

This is not a data-breach incident with regulatory consequences. Compromise can result in surveillance data surfacing on pro-Iranian leak sites and, per the agencies, has been associated with plots to kidnap or kill individuals abroad. The digital-to-physical kill chain is the part that separates this campaign from ordinary spyware.
Defenders supporting at-risk users — diaspora communities, investigative journalists, NGOs, human rights organizations — should treat this as a personal-safety incident, not an IT ticket.

Detection Opportunities Defenders Should Build Now

Physical Safety Elevates the Stakes
Monitor for outbound Telegram API traffic (api.telegram.org) originating from unusual or unsigned processes — not from the legitimate Telegram desktop client.
Hunt for executables masquerading as well-known brands (KeePass, Norton, Adobe Flash, Pictory, RunwayML) in user-writable directories like Downloads, AppData, and Temp.
Flag processes requesting microphone access (Media.Capture or WASAPI) outside expected, approved applications.
Review browser and email client behavior for unexplained credential prompts following a social-engineering contact — the initial lure often precedes credential harvesting.

Shield53 Recommendations

  • For at-risk organizations: Extend endpoint protection beyond corporate assets. Provide hardened, managed devices or MDM-enrolled phones for employees in diaspora, journalism, or advocacy roles. Personal-device security is now part of the corporate duty of care.
  • Application allowlisting: Enforce on workstations so that only signed, known binaries execute from user-writable paths. The droppers described rely on users running files from Downloads.
  • Network egress controls: Consider whether unrestricted Telegram access is required for your business. For organizations without a legitimate business need, egress filtering to Telegram endpoints can deny the C2 channel entirely.
  • Targeted awareness training: Move beyond generic phishing. Train staff on impersonation of known contacts and fake tech-support lures — the documented MOIS playbook. Specifically warn against opening files purporting to be MRI results or software updates shared by "support" accounts.
  • Physical-security coordination: Where compromise is suspected, involve physical security and legal counsel early. The threat model includes doxxing and physical harm, not just data loss.
  • Device hygiene for high-risk individuals: Hardware-disable or physically cover microphones when not in use; use dedicated devices for sensitive communications; factory-reset and re-enroll any device suspected of compromise rather than attempting to clean it.