FBI Warns Iran Used Telegram to Spy on Dissidents

The FBI warns Iran’s Ministry of Intelligence and Security is using Telegram as a command-and-control platform in a cyber campaign targeting dissidents and journalists. The malware attacks enable surveillance and data theft amid escalating geopolitical tensions in the Middle East. According to a recent alert, Iranian cyber actors deliver malware that disguises itself as legitimate apps to infiltrate Windows systems linked to opposition groups. After gaining access through social engineering, attackers deploy a multi-stage payload, connecting victims’ devices to a Telegram-based system. This setup allows for remote access, data theft, and damaging leaks. The FBI links this activity to groups like “Handala Hack” using advanced tactics combined with disinformation for political objectives. The malware records screens, captures data, and compresses files to exfiltrate via Telegram. The FBI warns Iran’s operations pose significant risks, urging vigilance against odd communications and promoting cybersecurity measures. For more details, read the full article:

Iran-linked actors use Telegram as C2 in malware attacks on dissidents