Cybersecurity agencies in the United States, the United Kingdom and the Netherlands have published a joint advisory on Windows malware they attribute to Iran's Ministry of Intelligence and Security (MOIS), saying it is used to spy on dissidents, journalists and activists worldwide.
The malware, called HEAVYGRAM by the FBI and CHOSEN BRICK by the UK's National Cyber Security Center, is controlled through the Telegram messaging app. It can copy emails and chat messages, take screenshots and switch on the microphone to record audio.
The advisory, released September 15 by the NCSC, the FBI and the Dutch AIVD, expands on a March 2026 FBI alert that first described the campaign. The FBI dates the wider operation to autumn 2023 and says the tool has been used against people in the UK, US, Netherlands and elsewhere since at least 2025. Targets are mainly Iranian dissidents, journalists opposed to Iran, activists and members of groups whose views clash with the government, though the FBI warns anyone Iran considers of interest could be targeted.
The agencies say the risk goes beyond stolen data: screenshots and other material can reveal a target's contacts, location and daily routine, and personal details of some victims have appeared on pro-Iranian leak sites. In March, the US Justice Department seized four such sites, which it said had been used to post stolen data and call for the killing of dissidents and journalists.
The attack starts with a message. Attackers pose as someone the target knows or as tech support for a messaging app, then send a file disguised as legitimate software - reported disguises include the AI video app Pictory, KeePass, Telegram, RunwayML, Norton Antivirus and Adobe Flash Player, and in some cases fake MRI scan results. Opening the file shows a convincing fake screen while the malware installs in the background. A first stage poses as the app; a second connects the machine to a Telegram bot used for control and data collection. Every version seen so far runs only on Windows.
To survive restarts, the malware adds itself to a Windows registry "Run" key and tells Microsoft Defender to skip certain folders. Each infected computer gets its own Telegram bot. Once running, it can list programs, take screenshots, activate the microphone, copy Telegram and WhatsApp data from browsers, steal passwords and email addresses, download more malware and delete files; at least one version can wipe the computer. Stolen files leave via the Telegram bot and cloud services such as Vultr and Storj, and newer versions route Telegram traffic through proxies.
The agencies list indicators including a "Run" key entry named SMQDService or winappx, a folder at C:\Windows \SysWOW64 with an added space, unexpected connections to services including api.telegram.org, vultrobjects.com, storjshare.io, backblazeb2.com, iproyal.com and lightningproxies.net, and mutex names such as ytyjyujyu and noi672pp434awkc12f. They warn file names and folders can change, so these should not be the only signs watched for.
Recommended protections include not opening files sent through messages, downloading software only from official sources, keeping systems and apps updated, running current antivirus software and not ignoring SmartScreen warnings. Network administrators are advised to enable phishing-resistant multi-factor authentication, use application allowlisting and managed-device controls, use their email provider's security tools, and monitor networks for the indicators. Suspected infections should be reported to IT support and the national cyber agency.
The advisories do not say whether removing the malware alone clears a compromise. When the FBI first warned in March, Telegram told TechCrunch its moderators "routinely remove any accounts found to be involved with malware." The agencies present their conclusions as assessments rather than matters settled in court.
Source: The Hackers News