Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists

Summary: Cybersecurity agencies in the U.S., U.K., and Netherlands published a joint advisory on September 15 describing Windows malware they attribute to Iran's Ministry of Intelligence and Security, which the FBI calls HEAVYGRAM and the NCSC calls CHOSEN BRICK. Controlled through a Telegram bot, the malware can copy emails and chat messages, take screenshots, activate the microphone, steal saved passwords, download additional tools, and in at least one version wipe the computer, with the campaign dated to autumn 2023 and use against targets since at least 2025.
What you should know: The agencies say screenshots and collected data can expose a target's contacts, location, and daily routine, and that personal details of some victims have appeared on pro-Iranian leak sites - a consequence that goes past data loss to physical safety, with the advisory noting Iranian intelligence services have in some cases plotted to kidnap or kill such people abroad.

Read the original at The Hacker News ↗