Loading story…
The FBI warned that hackers linked to Iran’s Ministry of Intelligence and Security (MOIS) are using Telegram as command-and-control infrastructure in malware campaigns targeting Iranian dissidents, journalists, and opposition groups worldwide. The activity, observed since late 2023, relies on social engineering in which attackers impersonate trusted contacts or tech support and deliver malware disguised as legitimate apps such as Telegram, WhatsApp, or KeePass. Once installed on Windows systems, the multi-stage malware establishes persistence and connects to Telegram bots, allowing operators to steal files, capture screenshots and audio, record Zoom calls, compress data, and exfiltrate information.
U.S. authorities said the operations appear tailored to victims’ behavior, suggesting prior reconnaissance, and tied the activity to broader MOIS influence and disruption efforts. The FBI said the same ecosystem includes the fake hacktivist brands Handala Hack and Homeland Justice, which it linked to hack-and-leak operations that combine APT-style intrusions with disinformation and selective data leaks to cause reputational and political harm. The Justice Department has separately described Handala as an MOIS front involved in the recent Stryker attack, while the FBI has seized websites associated with Handala and Homeland Justice.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On March 23, 2026, the FBI issued a public warning that MOIS-linked hackers were using Telegram bots as command-and-control infrastructure in multi-stage malware attacks. The alert said the malware enabled surveillance, file theft, screenshots, audio capture, and exfiltration from victims' systems.
The FBI seized websites associated with the purported hacktivist groups Handala and Homeland Justice, which U.S. authorities said were linked to and controlled by MOIS. The action accompanied broader public attribution of the groups' operations to Iran.
The U.S. Justice Department accused Handala of operating as a front for Iran's MOIS and of carrying out the recent Stryker attack. This publicly advanced U.S. government attribution of the group's activity to Iranian intelligence.
In 2025, the FBI linked hack-and-leak activity by Handala Hack to MOIS and to Homeland Justice. The operations combined intrusion activity with selective data leaks and disinformation to cause reputational and political harm.
Since late 2023, Iran-linked actors associated with the Ministry of Intelligence and Security (MOIS) have run malware campaigns targeting Iranian dissidents, journalists, and opposition groups worldwide. The attacks used social engineering and trojanized apps such as Telegram, WhatsApp, and KeePass to infect Windows systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcecyberscoop.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcetechcrunch.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI warned that cyber actors working on behalf of Iran’s **Ministry of Intelligence and Security (MOIS)** used Telegram as command-and-control infrastructure in a long-running malware campaign targeting Iranian dissidents, anti-regime journalists, and other opposition figures around the world. In FLASH-20260320-001, the bureau said the activity has been ongoing since at least fall 2023 and relied on social engineering and victim-tailored lures to deliver multi-stage Windows malware disguised as legitimate applications including **Telegram**, **KeePass**, **WhatsApp**, and **Pictory**. According to the alert, the second-stage implant enabled persistent remote access and bidirectional communications through Telegram infrastructure, allowing operators to steal files, compressed archives, screen captures, and audio from infected systems. The FBI also linked some July 2025 hack-and-leak activity claimed by **Handala Hack** to malware used in the campaign and assessed that Handala Hack is connected to **Homeland Justice**, which it described as another MOIS-operated online entity, underscoring Iran’s broader use of proxy personas and cyber operations to combine espionage, data theft, and information operations.
Jun 29, 2026
Researchers linked **Handala Hack** to Iran’s Ministry of Intelligence and Security as part of the broader **Void Manticore** cluster, describing a coordinated campaign that targeted organizations in Israel, Albania, and the United States with disruptive and destructive intrusions. Reported victims and incidents included attacks on **Stryker**, compromises affecting kindergarten emergency alert systems, and a personal Gmail breach publicly attributed to FBI Director Kash Patel that the FBI said involved historical, non-classified data. U.S. authorities also seized four domains allegedly used by the operation to leak stolen data, publicize attacks, and support influence activity. Investigators said the intrusions commonly began with **compromised VPN credentials**, followed by hands-on-keyboard movement over **RDP**, use of **NetBird** for tunneling, credential theft, Active Directory reconnaissance, and staged malware delivery. The destructive phase combined multiple methods at once, including a custom **Handala Wiper**, **PowerShell-based wiping**, **VeraCrypt** encryption, manual deletion of files and virtual machines, and tooling tied to webshell persistence, Telegram-linked data exfiltration, driver-assisted disk access, and attempts to disable endpoint defenses. Analysts also tied Handala to other MOIS personas including **Homeland Justice** and **Karma**, saying the fronts shared infrastructure, domain patterns, Telegram-based communications, and overlapping tradecraft in a single coordinated state-backed campaign.
Jun 29, 2026
Check Point Research reported that the **Rampant Kitten** espionage campaign targeted Iranian expats, dissidents, minorities, and anti-regime organizations in a long-running intelligence-gathering operation attributed to Iran-linked actors. The activity focused on collecting sensitive victim data, including **Telegram Desktop** files, **KeePass** password data, documents, and SMS-based two-factor authentication codes, indicating a strong emphasis on surveillance of perceived opponents of the Iranian regime. Researchers tied the operation to multiple malware families and infrastructure clusters active since 2014, including **TelB**, **TelAndExt**, a Python infostealer, and **HookInjEx**. The attackers used several delivery methods across platforms, including malicious documents, fake software downloads, phishing pages impersonating Telegram, Windows infostealers, and an Android backdoor, showing a sustained and multi-vector effort to compromise targets and exfiltrate communications and credentials.
Aug 15, 2026