Iranian MOIS Uses HEAVYGRAM Malware via Telegram C2
Iranian Spies Use Telegram-Controlled Malware 'HEAVYGRAM' on Dissidents
Related Entities
Threat Actors
Organizations
Products & Tech
Other
Full Report
Executive Summary
An international joint cybersecurity advisory from the FBI, UK's NCSC, and the Netherlands' AIVD has detailed a sophisticated cyber-espionage campaign attributed to Iran's Ministry of Intelligence and Security (MOIS). The campaign targets Iranian dissidents, journalists, and activists globally using a Windows malware implant known as HEAVYGRAM (FBI) or CHOSEN BRICK (NCSC). The malware is notable for its use of the Telegram messaging service's API for covert command-and-control (C2) communications. Its functions include data theft, screenshot capture, and audio recording, posing a significant threat to the privacy and safety of its targets.
Threat Overview
The campaign, active since at least 2025, is part of a broader effort by the Iranian government to monitor and suppress opposition voices. Targets are located in the United States, United Kingdom, Netherlands, and other nations. The malware provides its operators with extensive surveillance capabilities.
The use of Telegram for C2 is a strategic choice, as it allows the malware's traffic to blend in with legitimate messaging activity, making it harder to detect on a network. The attackers can send commands to the implant and receive exfiltrated data through the Telegram Bot API, leveraging a widely used public service as their C2 infrastructure.
Technical Analysis
HEAVYGRAM is a Windows-based implant designed for surveillance and data exfiltration. Its core capabilities include:
- File Collection: Stealing files, including emails and chat messages.
- Screen Capture: Periodically taking screenshots of the victim's desktop (
T1113 - Screen Capture). - Audio Recording: Activating the device's microphone to record ambient audio (
T1123 - Audio Capture). - Keylogging: Capturing keystrokes to steal credentials and other typed information (
T1056.001 - Keylogging).
C2 Mechanism
The malware communicates via the Telegram Bot API over HTTPS. It sends stolen data to a Telegram channel controlled by the attackers and polls for new commands. This method abuses a legitimate, encrypted service, making detection based on network signatures challenging.
MITRE ATT&CK Techniques
T1204.002 - Malicious File: The malware is likely delivered via social engineering, tricking targets into executing a malicious file.T1071.001 - Web Protocols: Use of HTTPS to communicate with the Telegram API for C2.T1113 - Screen Capture: Capability to capture screenshots.T1123 - Audio Capture: Capability to record audio.T1056.001 - Keylogging: Capability to log keystrokes.T1567 - Exfiltration Over Web Service: Exfiltrating stolen data using the Telegram service.
Impact Assessment
The primary impact is on the personal safety and privacy of the targeted individuals. The advisory notes that information collected by the malware has been published on pro-Iranian leak sites. This 'doxing' tactic is used to intimidate, harass, and endanger dissidents and their families. For the targeted individuals, the risk extends beyond data loss to physical harm and persecution. The campaign represents a significant nation-state threat to freedom of expression and human rights.
IOCs — Directly from Articles
No specific Indicators of Compromise (IOCs) were provided in the source articles.
Detection & Response
- Network Traffic Analysis: While the traffic is encrypted, monitoring for persistent connections to
api.telegram.orgfrom endpoints that do not have the Telegram desktop client installed can be an indicator. Correlate network data with process data to identify which application is making the connection. (D3-NTA: Network Traffic Analysis) - Endpoint Monitoring: Use an EDR solution to monitor for suspicious process behaviors, such as an unknown process making API calls related to screen capture, microphone access, or keylogging. (D3-PA: Process Analysis)
- DNS/URL Filtering: While blocking
api.telegram.orgmay impact legitimate use, consider blocking it for sensitive systems or users who have no business need for the service.
Mitigation
- User Training: High-risk individuals should be trained to recognize and avoid phishing attempts and social engineering tactics used to deliver malware. (M1017: User Training)
- Antivirus/EDR: Ensure endpoints are protected with up-to-date antivirus and EDR solutions capable of detecting and blocking known malware like HEAVYGRAM. (M1049: Antivirus/Antimalware)
- Application Control: Implement application allowlisting to prevent the execution of unauthorized software, which would stop the initial malware payload from running. (M1038: Execution Prevention)
- Least Privilege: Ensure user accounts operate with the lowest possible privilege level to limit the malware's ability to access system resources and persist.
Timeline of Events
MITRE ATT&CK Mitigations
Antivirus/Antimalware
Use EDR and antivirus solutions to detect and block the HEAVYGRAM malware based on signatures and behavioral analysis.
Restrict Web-Based Content
Filter outbound network traffic to block connections to api.telegram.org from unauthorized applications.
Mapped D3FEND Techniques:
User Training
Educate high-risk users on identifying and avoiding phishing and social engineering attempts.
D3FEND Defensive Countermeasures
Implement egress filtering rules on perimeter firewalls and web proxies to control access to api.telegram.org. For most corporate environments, there is no legitimate business need for servers or workstations to communicate directly with the Telegram API. Create a policy that denies this traffic by default. For the small subset of users who may require access (e.g., marketing teams), create a specific allow rule based on user group or source IP. This filtering directly disrupts the malware's C2 channel (T1071.001), preventing it from receiving commands or exfiltrating data. By blocking the C2 communication, the implant is effectively neutralized, even if it manages to infect an endpoint.
Use an EDR solution to perform behavioral analysis of running processes. Create detection rules that alert on suspicious API call combinations indicative of spyware. For HEAVYGRAM, this would involve a single process making calls to capture screenshots (e.g., BitBlt), record audio (waveInOpen), and establish network connections to api.telegram.org. A process that is not the official Telegram client exhibiting this combination of behaviors is a very high-fidelity indicator of compromise. This technique allows for the detection of the malware based on its actions, rather than relying on static file signatures, making it effective against new or polymorphic variants.
For high-risk users such as journalists and activists, implement application allowlisting on their workstations. Configure the system to only permit the execution of known, trusted applications. This 'default-deny' posture would prevent the initial HEAVYGRAM payload from executing, even if the user is tricked into downloading and clicking it (T1204.002). While implementing allowlisting requires a significant initial effort to build the baseline of approved software, it is one of the most effective defenses against malware delivery. For the targeted user base in this campaign, the enhanced security posture justifies the operational overhead.
Timeline of Events
HEAVYGRAM / CHOSEN BRICK campaign begins, targeting dissidents and journalists.
The FBI first issues an alert describing the espionage campaign.
A joint advisory is published by the FBI, NCSC, and AIVD with updated details on the malware and campaign.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.