Loading story…
The FBI assesses that cyber actors linked to Iran’s Ministry of Intelligence and Security (MOIS) have used the modular Windows malware framework HEAVYGRAM since fall 2023 against Iranian dissidents, anti-government journalists, opposition groups, and other individuals Tehran considers threats worldwide. The operators use Telegram, WhatsApp, and Instagram social-engineering lures, impersonating IT-service providers to persuade targets to install AnyDesk or trojanized applications posing as Pictory Premium, Telegram Authenticator, and KeePass.
HEAVYGRAM uses Telegram Bot API infrastructure for command-and-control and data exfiltration, while Vultr S3 storage supports payload and data staging. Its implants can conduct host reconnaissance, execute commands, capture screenshots, steal browser credentials and sessions, collect Telegram and WhatsApp data and Outlook and Gmail content, and access removable media; optional modules enable screen and audio recording. Organizations supporting at-risk Iranian communities should scrutinize suspicious remote-access deployments and look for Telegram-based C2 activity, credential theft, and counterfeit software installers.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
The U.S. Department of Justice announced the seizure of four MOIS-linked domains, including Justicehomeland[.]org, Karmabelow80[.]org, Handala-Redwanted[.]to, and Handala-Hack[.]to. Its affidavit also described HEAVYGRAM intrusions involving a UK-based Farsi-language journalist and a separate U.S.-based victim.
FBI assesses that Iranian Ministry of Intelligence and Security cyber actors began using HEAVYGRAM against Iranian dissidents, anti-government journalists, opposition organizations, and other perceived threats worldwide. The actors used social engineering on Telegram, WhatsApp, and Instagram to induce targets to install AnyDesk or trojanized software.
Gurucul documented HEAVYGRAM lure filenames, Vultrobjects object-storage payload-hosting URLs, and associated MD5, SHA-1, and SHA-256 hashes. The report also detailed the backdoor's Telegram-based command-and-control and exfiltration, screenshot capture, remote command execution, persistence, and DLL sideloading capabilities.
Handala Hack was assessed to be operated by Void Manticore, also known as Banished Kitten, Red Sandstorm, and Storm-0842, an actor affiliated with Iran's Ministry of Intelligence and Security. The assessment links this persona to the HEAVYGRAM backdoor and CRUDEEXCLUDE defense-evasion utility.
Group-IB assessed with moderate confidence that the HEAVYGRAM surveillance operation is linked to Handala Hack and identified 29 additional HEAVYGRAM-related samples, loaders, and payloads. The investigation also associated CRUDEEXCLUDE with the campaign, noting that it may create security-exclusion paths before HEAVYGRAM deployment.
The FBI released an updated FLASH containing technical analysis and additional indicators for HEAVYGRAM, assessing that MOIS actors use the malware for intelligence collection, data leaks, and reputational harm on behalf of Iran.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 135 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcethehackernews.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcegroup-ib.com
Open sourcefbi.gov
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI warned that cyber actors working on behalf of Iran’s **Ministry of Intelligence and Security (MOIS)** used Telegram as command-and-control infrastructure in a long-running malware campaign targeting Iranian dissidents, anti-regime journalists, and other opposition figures around the world. In FLASH-20260320-001, the bureau said the activity has been ongoing since at least fall 2023 and relied on social engineering and victim-tailored lures to deliver multi-stage Windows malware disguised as legitimate applications including **Telegram**, **KeePass**, **WhatsApp**, and **Pictory**. According to the alert, the second-stage implant enabled persistent remote access and bidirectional communications through Telegram infrastructure, allowing operators to steal files, compressed archives, screen captures, and audio from infected systems. The FBI also linked some July 2025 hack-and-leak activity claimed by **Handala Hack** to malware used in the campaign and assessed that Handala Hack is connected to **Homeland Justice**, which it described as another MOIS-operated online entity, underscoring Iran’s broader use of proxy personas and cyber operations to combine espionage, data theft, and information operations.
Jun 29, 2026
The FBI warned that hackers linked to Iran’s Ministry of Intelligence and Security (MOIS) are using Telegram as command-and-control infrastructure in malware campaigns targeting Iranian dissidents, journalists, and opposition groups worldwide. The activity, observed since late 2023, relies on social engineering in which attackers impersonate trusted contacts or tech support and deliver malware disguised as legitimate apps such as Telegram, WhatsApp, or KeePass. Once installed on Windows systems, the multi-stage malware establishes persistence and connects to Telegram bots, allowing operators to steal files, capture screenshots and audio, record Zoom calls, compress data, and exfiltrate information. U.S. authorities said the operations appear tailored to victims’ behavior, suggesting prior reconnaissance, and tied the activity to broader MOIS influence and disruption efforts. The FBI said the same ecosystem includes the fake hacktivist brands **Handala Hack** and **Homeland Justice**, which it linked to hack-and-leak operations that combine APT-style intrusions with disinformation and selective data leaks to cause reputational and political harm. The Justice Department has separately described Handala as an MOIS front involved in the recent Stryker attack, while the FBI has seized websites associated with Handala and Homeland Justice.
Jun 29, 2026
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026