Iran's MOIS Uses Telegram-Controlled Spyware Against Dissidents

On 15 September 2026, the FBI, the UK's National Cyber Security Centre (NCSC), and the Netherlands' AIVD published a joint advisory attributing a Windows spyware family to Iran's Ministry of Intelligence and Security (MOIS). The FBI designates it HEAVYGRAM; the NCSC calls it CHOSEN BRICK. Both names describe the same campaign, which the FBI dates back to autumn 2023.

A Telegram bot as the command channel

What makes this operation notable isn't the spyware's feature set — it's fairly standard for state-linked implants — but its control channel. After initial infection, a second stage connects the compromised machine to a Telegram bot that operators use both to issue commands and to receive stolen data. Newer variants route this Telegram traffic through proxy infrastructure, which blends malicious C2 calls into traffic that looks like ordinary Telegram API usage — a technique that has become increasingly common precisely because it complicates network-based detection without requiring custom protocol engineering.

Capabilities

• Copying emails and chat messages
• Capturing screenshots and activating the microphone for audio recording
• Listing running programs and extracting Telegram/WhatsApp browser data
• Harvesting saved passwords and email addresses
• Downloading additional malware, and in some versions, deleting files or wiping the machine

Who is being targeted, and how

According to the advisory, the targets are mainly Iranian dissidents, journalists critical of Iran, activists, and members of groups whose views conflict with the government — located in the UK, US, Netherlands, and more broadly. The NCSC described the delivery method as tailored spear-phishing over WhatsApp and Telegram: attackers posed as trusted contacts and, in some cases, used fabricated documents — including fake MRI test results — to persuade specific individuals to open the malicious payload. This is social engineering built around a single target's life circumstances, not a mass phishing blast.

The NCSC also noted that some victims' personal details later appeared on pro-Iranian leak sites — meaning the operation's value to MOIS extends beyond intelligence collection into reputational harm and intimidation of people who are often already at personal risk.

Why this matters beyond the immediate targets

Three governments co-signing one advisory on a single spyware family signals sustained, cross-border targeting rather than an isolated incident. For defenders more broadly, the pattern is worth internalizing even outside the activist and journalist community it's aimed at: legitimate consumer platforms (Telegram, WhatsApp) are increasingly used as both the lure and the infrastructure, which means detection has to look past the fact that traffic to api.telegram.org looks routine. Organizations that support at-risk individuals — NGOs, press-freedom bodies, diaspora groups — are the ones most likely to see this specific campaign, and should treat unsolicited documents from known contacts on messaging apps as a credible delivery vector, not just email attachments.

Practical mitigations from the advisory align with general anti-spyware hygiene: verify unexpected files from known contacts through a second channel before opening them, watch for unusual Telegram/API network activity from endpoints that shouldn't be using it, and treat devices belonging to high-risk individuals (journalists, activists) as requiring elevated monitoring rather than standard consumer-grade defenses.