Loading story…
The FBI warned that cyber actors working on behalf of Iran’s Ministry of Intelligence and Security (MOIS) used Telegram as command-and-control infrastructure in a long-running malware campaign targeting Iranian dissidents, anti-regime journalists, and other opposition figures around the world. In FLASH-20260320-001, the bureau said the activity has been ongoing since at least fall 2023 and relied on social engineering and victim-tailored lures to deliver multi-stage Windows malware disguised as legitimate applications including Telegram, KeePass, WhatsApp, and Pictory.
According to the alert, the second-stage implant enabled persistent remote access and bidirectional communications through Telegram infrastructure, allowing operators to steal files, compressed archives, screen captures, and audio from infected systems. The FBI also linked some July 2025 hack-and-leak activity claimed by Handala Hack to malware used in the campaign and assessed that Handala Hack is connected to Homeland Justice, which it described as another MOIS-operated online entity, underscoring Iran’s broader use of proxy personas and cyber operations to combine espionage, data theft, and information operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-20, the FBI issued FLASH-20260320-001 warning that MOIS-linked cyber actors were using Telegram as command-and-control infrastructure to deliver and operate multi-stage malware. The alert described the malware’s persistent remote-access and data-theft capabilities, including collection of screen captures, audio, files, and compressed archives.
In July 2025, some hack-and-leak activity publicly claimed by Handala Hack was linked by the FBI to malware used in the broader MOIS-associated campaign. The FBI also assessed that Handala Hack is connected to Homeland Justice, another online entity operated by MOIS.
Cyber actors working on behalf of Iran’s Ministry of Intelligence and Security began a malware campaign targeting Iranian dissidents, anti-regime journalists, and other opposition figures worldwide. The activity, active since at least fall 2023, used social engineering and trojanized Windows applications masquerading as tools such as Telegram, KeePass, WhatsApp, and Pictory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI warned that hackers linked to Iran’s Ministry of Intelligence and Security (MOIS) are using Telegram as command-and-control infrastructure in malware campaigns targeting Iranian dissidents, journalists, and opposition groups worldwide. The activity, observed since late 2023, relies on social engineering in which attackers impersonate trusted contacts or tech support and deliver malware disguised as legitimate apps such as Telegram, WhatsApp, or KeePass. Once installed on Windows systems, the multi-stage malware establishes persistence and connects to Telegram bots, allowing operators to steal files, capture screenshots and audio, record Zoom calls, compress data, and exfiltrate information. U.S. authorities said the operations appear tailored to victims’ behavior, suggesting prior reconnaissance, and tied the activity to broader MOIS influence and disruption efforts. The FBI said the same ecosystem includes the fake hacktivist brands **Handala Hack** and **Homeland Justice**, which it linked to hack-and-leak operations that combine APT-style intrusions with disinformation and selective data leaks to cause reputational and political harm. The Justice Department has separately described Handala as an MOIS front involved in the recent Stryker attack, while the FBI has seized websites associated with Handala and Homeland Justice.
Jun 29, 2026
Check Point Research reported that the **Rampant Kitten** espionage campaign targeted Iranian expats, dissidents, minorities, and anti-regime organizations in a long-running intelligence-gathering operation attributed to Iran-linked actors. The activity focused on collecting sensitive victim data, including **Telegram Desktop** files, **KeePass** password data, documents, and SMS-based two-factor authentication codes, indicating a strong emphasis on surveillance of perceived opponents of the Iranian regime. Researchers tied the operation to multiple malware families and infrastructure clusters active since 2014, including **TelB**, **TelAndExt**, a Python infostealer, and **HookInjEx**. The attackers used several delivery methods across platforms, including malicious documents, fake software downloads, phishing pages impersonating Telegram, Windows infostealers, and an Android backdoor, showing a sustained and multi-vector effort to compromise targets and exfiltrate communications and credentials.
Aug 15, 2026
Researchers linked **Handala Hack** to Iran’s Ministry of Intelligence and Security as part of the broader **Void Manticore** cluster, describing a coordinated campaign that targeted organizations in Israel, Albania, and the United States with disruptive and destructive intrusions. Reported victims and incidents included attacks on **Stryker**, compromises affecting kindergarten emergency alert systems, and a personal Gmail breach publicly attributed to FBI Director Kash Patel that the FBI said involved historical, non-classified data. U.S. authorities also seized four domains allegedly used by the operation to leak stolen data, publicize attacks, and support influence activity. Investigators said the intrusions commonly began with **compromised VPN credentials**, followed by hands-on-keyboard movement over **RDP**, use of **NetBird** for tunneling, credential theft, Active Directory reconnaissance, and staged malware delivery. The destructive phase combined multiple methods at once, including a custom **Handala Wiper**, **PowerShell-based wiping**, **VeraCrypt** encryption, manual deletion of files and virtual machines, and tooling tied to webshell persistence, Telegram-linked data exfiltration, driver-assisted disk access, and attempts to disable endpoint defenses. Analysts also tied Handala to other MOIS personas including **Homeland Justice** and **Karma**, saying the fronts shared infrastructure, domain patterns, Telegram-based communications, and overlapping tradecraft in a single coordinated state-backed campaign.
Jun 29, 2026