Iran-Linked HEAVYGRAM Malware Uses Telegram to Spy on Dissidents and Journalists
Summary
U.S., U.K., and Dutch agencies say Iran-linked HEAVYGRAM/CHOSEN BRICK malware targets dissidents, journalists, and activists, using deceptive Windows files and Telegram to steal data and record audio.
Key points
- Agencies attribute the campaign to Iran’s Ministry of Intelligence and Security and say it has targeted people of interest since at least 2025.
- Attackers reportedly build trust through messages before sending fake software files; observed disguises include KeePass, Telegram, and Pictory.
- The Windows malware uses a staged installation and a Telegram bot for remote control and stolen-data collection.
- Capabilities include stealing messages, emails, and saved passwords; taking screenshots; recording microphone audio; downloading malware; and deleting files. One version can wipe a computer.
- The malware reportedly persists through Windows Run keys and tells Microsoft Defender to skip certain folders; newer versions route Telegram traffic through proxies.
- Agencies recommend using official software sources, keeping protections updated, enabling phishing-resistant MFA, and monitoring devices and network traffic for suspicious activity.
Article Details
- Attack Vectors
- Attackers reportedly impersonate a known contact or messaging-app tech support and send deceptive files disguised as legitimate software or MRI scan results.
- The malware installs in two stages, presenting a fake screen while the payload installs in the background; reported versions run only on Windows.
- The malware establishes persistence through Windows registry Run keys named SMQDService or winappx and can add exclusions in Microsoft Defender.
- Telegram bots are used for command and control and data collection; newer versions reportedly route Telegram traffic through proxy servers.
- The malware can steal messages, emails, saved passwords, screenshots, and microphone audio; it can also download additional malware, delete files, and, in at least one version, wipe the computer.
- Defensive Notes
- Avoid opening files received through messages or links; obtain software only from official websites or app stores.
- Keep operating systems and applications updated, run current antivirus software, and heed SmartScreen warnings.
- Administrators are advised to use phishing-resistant multi-factor authentication, application allowlisting, managed-device controls, and email-provider security tools.
- Monitor computers and network traffic for the listed registry entries, paths, mutexes, and unexpected connections; report suspected infections to IT support and the relevant national cyber agency.
- The advisories do not establish whether removing the malware alone clears a compromise.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]telegram[.]org | Listed by the agencies as a network indicator associated with malware Telegram traffic. |
| DOMAIN | backblazeb2[.]com | Listed as a network indicator associated with the malware campaign. |
| DOMAIN | iproyal[.]com | Listed by the agencies as a network indicator associated with proxy connections used by newer malware versions. |
| DOMAIN | lightningproxies[.]net | Listed by the agencies as a network indicator associated with proxy connections used by newer malware versions. |
| DOMAIN | storjshare[.]io | Listed as a network indicator associated with cloud storage used for stolen-file transfer. |
| DOMAIN | vultrobjects[.]com | Listed as a network indicator; the article says stolen files leave infected computers through cloud storage services such as Vultr. |
MITRE ATT&CK
T1036 · MasqueradingThe malware is delivered as deceptive files disguised as legitimate software or MRI scan results, and displays a convincing fake screen.T1056.001 · KeyloggingThe malware can steal saved passwords and email addresses.T1070.004 · File DeletionThe malware can delete files on the infected computer.T1082 · System Information DiscoveryThe malware can list running programs on an infected computer.T1105 · Ingress Tool TransferThe malware can download additional malware or tools.T1113 · Screen CaptureThe malware can take screenshots of the victim's computer.T1123 · Audio CaptureThe malware can activate the microphone to record audio.T1485 · Data DestructionAt least one version can wipe the computer, according to the joint advisory.T1547.001 · Registry Run Keys / Startup FolderThe malware adds itself to a Windows registry Run key so it starts when the user logs in.T1562.001 · Disable or Modify ToolsThe malware reportedly tells Microsoft Defender to skip folders so its files are not scanned.T1567 · Exfiltration Over Web ServiceStolen files reportedly leave infected computers through Telegram bots and cloud storage services.
Threat Actors
Malware
CHOSEN BRICKU.S., U.K., and Dutch agencies say an Iran-linked Windows malware campaign known as HEAVYGRAM and CHOSEN BRICK is used to spy on dissidents, journalists, and activists by stealing messages, screenshots, passwords, andHEAVYGRAMU.S., U.K., and Dutch agencies say an Iran-linked Windows malware campaign known as HEAVYGRAM and CHOSEN BRICK is used to spy on dissidents, journalists, and activists by stealing messages, screenshots, passwords, and
Products
Adobe Flash PlayerReported disguises include the AI video app Pictory, the password manager KeePass, Telegram itself, RunwayML, Norton Antivirus, and Adobe Flash Player.KeePassReported disguises include the AI video app Pictory, the password manager KeePass, Telegram itself, RunwayML, Norton Antivirus, and Adobe Flash Player.Microsoft Defender Antimalware PlatformIt also tells Microsoft Defender, the built-in antivirus, to skip certain folders so its files are not scanned.Microsoft WindowsU.S., U.K., and Dutch agencies say an Iran-linked Windows malware campaign known as HEAVYGRAM and CHOSEN BRICK is used to spy on dissidents, journalists, and activists by stealing messages, screenshots, passwords, andNorton AntivirusReported disguises include the AI video app Pictory, the password manager KeePass, Telegram itself, RunwayML, Norton Antivirus, and Adobe Flash Player.PictoryReported disguises include the AI video app Pictory, the password manager KeePass, Telegram itself, RunwayML, Norton Antivirus, and Adobe Flash Player.RunwayMLReported disguises include the AI video app Pictory, the password manager KeePass, Telegram itself, RunwayML, Norton Antivirus, and Adobe Flash Player.TelegramThe malware spreads through deceptive files, uses Telegram for command and data theft, and has indicators tied to Iran’s MOIS, Telegram, and several cloud or proxy services.WhatsAppto do many things: list running programs, take screenshots, turn on the microphone, copy Telegram and WhatsApp data from the browser, steal saved passwords and email addresses, download additional malware, and
Countries
IranU.S., U.K., and Dutch agencies say an Iran-linked Windows malware campaign known as HEAVYGRAM and CHOSEN BRICK is used to spy on dissidents, journalists, and activists by stealing messages, screenshots, passwords, andNetherlandsCybersecurity agencies in the United States, the United Kingdom, and the Netherlands have detailed a Windows malware that they say Iran’s intelligence service uses to spy on dissidents, journalists, and activists aroundUnited KingdomCybersecurity agencies in the United States, the United Kingdom, and the Netherlands have detailed a Windows malware that they say Iran’s intelligence service uses to spy on dissidents, journalists, and activists aroundUnited StatesCybersecurity agencies in the United States, the United Kingdom, and the Netherlands have detailed a Windows malware that they say Iran’s intelligence service uses to spy on dissidents, journalists, and activists around