Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists

Cybersecurity agencies from the United States, United Kingdom, and Netherlands have jointly detailed a Windows-based malware attributed to Iran's intelligence service. The malware is controlled through the Telegram messaging application, enabling covert command and control. It targets dissidents, journalists, and activists globally. Capabilities include copying emails and chat messages, taking screenshots, and activating the microphone to record audio. The operation represents a state-sponsored surveillance campaign against political opponents and civil society members. The use of a legitimate messaging platform like Telegram as a C2 channel helps evade traditional network detection. The joint advisory underscores the international concern over Iranian cyber espionage activities.