Iranian Intelligence Deploys Telegram-Controlled 'HEAVYGRAM' Malware to Target Global Dissidents

Executive Summary

On September 15, 2026, a coalition of international intelligence and cybersecurity agencies, including the FBI, the UK's NCSC, and the Netherlands' AIVD, issued a joint advisory regarding a persistent cyber-espionage campaign orchestrated by Iranian state-affiliated actors. The campaign leverages a custom Windows-based malware, identified as HEAVYGRAM (also tracked as CHOSEN BRICK), to conduct surveillance on dissidents, journalists, and political activists globally.

Threat Analysis

The threat actor utilizes a novel command-and-control (C2) architecture that relies on the Telegram messaging platform to bypass traditional network security controls. By embedding C2 instructions within Telegram channels, the attackers maintain a low profile, making it difficult for standard enterprise security tools to detect the malicious traffic patterns associated with the malware's communication.

Technical Details

HEAVYGRAM is a modular Windows backdoor designed for deep system infiltration. Once deployed on a target machine, the malware provides the operator with extensive capabilities, including:

• Real-time screen capture and screenshot logging.
• Exfiltration of email archives and private chat histories.
• Remote activation of the host's microphone for covert audio surveillance.
• File system traversal and data exfiltration to attacker-controlled servers. The malware's reliance on Telegram's API for C2 communication allows the operators to issue commands dynamically, facilitating a highly responsive and stealthy espionage operation that persists even after initial infection.

Attribution Assessment

Intelligence agencies have attributed this campaign to Iranian state-sponsored actors linked to the Ministry of Intelligence and Security (MOIS). This activity aligns with a broader trend of Iranian APT groups, such as those recently identified using the 'Cavern' C2 framework, increasingly adopting encrypted messaging platforms to obfuscate their operations against high-value targets.

Implications

The use of legitimate, widely-used communication platforms like Telegram for malicious C2 infrastructure represents a significant challenge for defenders. This tactic effectively weaponizes common enterprise tools, complicating the ability of organizations to distinguish between authorized traffic and state-sponsored espionage activity. The targeting of journalists and activists suggests a strategic focus on silencing dissent and gathering intelligence on political opposition.

Recommendations

1. Implement strict egress filtering to restrict unauthorized communication with public messaging APIs where not required for business operations.
2. Deploy advanced endpoint detection and response (EDR) solutions configured to monitor for suspicious audio recording and screen-capture processes.
3. Conduct regular threat hunting exercises focused on identifying anomalous process execution chains associated with Telegram-based C2 traffic.
4. Provide security awareness training to high-risk personnel regarding the dangers of social engineering and the potential for malware delivery via seemingly benign communication channels.