Iranian Intelligence Linked to Global Cyber-Espionage Campaign Targeting Dissidents and Journalists

Cybersecurity authorities in the United States, the United Kingdom, and the Netherlands have issued a stark warning regarding a sophisticated Windows-based malware operation orchestrated by Iranian intelligence services. This digital campaign, which has been active since at least the autumn of 2023, is specifically designed to conduct surveillance on individuals whom the Iranian state views as threats, including journalists, activists, and political dissidents residing abroad. The operation utilizes a modular malware strain—referred to by the FBI as HEAVYGRAM and by the U.K.’s National Cyber Security Center (NCSC) as CHOSEN BRICK—to exfiltrate sensitive data and maintain persistent access to the devices of high-profile targets.

The joint advisory, released on September 15, serves as an update to a March 2026 alert that first exposed the malicious activity. According to the intelligence agencies, the campaign is attributed to the Iranian Ministry of Intelligence and Security (MOIS), an agency that has long been accused of operating beyond its borders to suppress opposition. The scope of this campaign is global, with confirmed compromises spanning multiple continents, reflecting a strategic effort to monitor and potentially silence dissenters wherever they may be located.

Chronology of the Surveillance Campaign

The origins of this specific digital offensive trace back to late 2023, when security researchers first noted an uptick in targeted phishing attempts directed at Iranian expatriate communities. By early 2025, the campaign had matured into a more refined operation, utilizing the Telegram messaging platform as a command-and-control (C2) infrastructure.

In March 2026, the FBI issued its initial public warning, revealing that Iranian actors were successfully pushing malware to specific targets by masquerading as trusted contacts or legitimate technical support personnel. The September 2026 joint advisory significantly expanded upon those findings, providing granular technical indicators and forensic evidence that links the MOIS directly to the development and deployment of the CHOSEN BRICK malware. This progression highlights an evolving threat landscape where state-sponsored actors are increasingly leveraging popular, encrypted communication platforms like Telegram to mask their malicious traffic and bypass traditional network security controls.

Technical Mechanics of the HEAVYGRAM/CHOSEN BRICK Malware

The sophistication of this malware lies in its ability to blend into the user’s daily environment. The attack vector typically initiates via social engineering. Attackers meticulously build rapport with their targets, often posing as colleagues, professional acquaintances, or even IT support representatives for popular communication applications. Once trust is established, the target is prompted to download a file that appears to be a legitimate software utility.

The list of "disguises" employed by the MOIS is extensive, reflecting a deep understanding of the tools used by journalists and activists. Forensic analysis has identified that the malware has been packaged as:

• Productivity Tools: AI-driven video editors such as Pictory or RunwayML.
• Security Software: Password managers like KeePass and antivirus solutions such as Norton.
• System Utilities: Adobe Flash Player components and, in highly targeted instances, files disguised as sensitive medical documentation, such as MRI scan results.

Upon execution, the malware deploys a two-stage process. The first stage presents a benign "decoy" interface to the user, ensuring the victim remains unaware of the malicious activity occurring in the background. The second stage establishes a connection to a specific Telegram bot. This bot serves as the primary conduit for the attacker to send instructions and receive stolen data. To ensure persistence, the malware modifies the Windows Registry "Run" key, guaranteeing that it activates automatically upon system reboot. Furthermore, it proactively modifies Microsoft Defender’s exclusion settings, effectively instructing the operating system’s built-in security to ignore the malicious directories.

Data Exfiltration and Potential Physical Risks

The implications of a successful infection extend far beyond simple data theft. Once the malware is established, it grants the attacker near-total control over the victim’s machine. It possesses the capability to log keystrokes, capture real-time screenshots, activate microphones for ambient audio recording, and extract saved browser data, including passwords and chat histories from platforms like WhatsApp and Telegram.

The intelligence agencies emphasize that the data collected is frequently used to map a target’s social circle, physical location, and daily routines. This information is not merely used for intelligence gathering; in several documented instances, the stolen personal details have been surfaced on pro-Iranian "leak sites." The U.S. Department of Justice intervened in March 2026 to seize four such domains, noting that these platforms were not only hosting stolen data but were actively calling for violence against dissidents and journalists. This suggests a dangerous nexus between cyber-espionage and physical intimidation, where the MOIS utilizes digital surveillance to facilitate state-sponsored kidnapping or assassination plots abroad.

Official Responses and International Cooperation

The coordinated release of the advisory by the FBI, the NCSC, and the Netherlands’ AIVD underscores the severity of the threat and the necessity of international intelligence sharing. By standardizing the indicators of compromise (IOCs)—such as specific file hashes and network traffic patterns—the agencies aim to empower network administrators and at-risk individuals to identify and remediate potential infections.

Regarding the role of Telegram, the platform has historically maintained that it operates as a neutral communication service. In response to previous reports concerning the use of its infrastructure for command-and-control, Telegram representatives noted that their moderation teams routinely remove accounts flagged for involvement in malicious activity. However, security experts argue that the decentralized nature of Telegram’s bot API makes it a persistent challenge for platform moderators, as attackers can easily cycle through new bots as old ones are identified and shut down.

Broader Implications and Strategic Analysis

The use of CHOSEN BRICK by the Iranian government represents a broader trend in the geopolitical use of cyber tools. State actors are increasingly moving away from high-profile, "noisy" attacks that might trigger international sanctions, opting instead for "low and slow" espionage operations that prioritize stealth and long-term persistence.

For the international community, the challenge is twofold. First, there is the technical hurdle of detecting malware that leverages legitimate, encrypted services to bypass network perimeter defenses. Second, there is the human element: the attackers rely heavily on the exploitation of trust. Because the targets are often individuals operating in high-risk environments, they are frequent users of messaging apps and productivity tools, making them prime candidates for the sophisticated social engineering tactics documented by the FBI.

Recommendations for Mitigation

Security agencies have provided a comprehensive roadmap for both individual users and enterprise IT administrators to defend against these intrusions:

For Individuals:

• Verify Source Credibility: Never download or execute files from unsolicited messages, even if they appear to come from known contacts.
• Enable Multi-Factor Authentication (MFA): While not a total defense against all malware, MFA remains a critical layer of protection for accounts.
• Monitor System Integrity: Regularly inspect the Windows Registry for suspicious entries under "Run" keys and verify that no unexpected folders have been added to the Microsoft Defender exclusion list.
• Report Anomalies: Any suspicious behavior or unexpected prompts should be reported immediately to national cybersecurity authorities.

For Network Administrators:

• Implement Egress Filtering: Restrict traffic to known malicious domains and monitor for unusual outbound traffic to cloud storage providers like Vultr and Storj.
• Endpoint Detection and Response (EDR): Deploy advanced EDR solutions that can detect anomalous processes and behavior, rather than relying solely on signature-based detection.
• Behavioral Monitoring: Establish baselines for normal network behavior and alert on spikes in data transfer volumes or connections to unauthorized Telegram bots.

As the geopolitical climate remains tense, the MOIS is expected to continue refining its toolset. The transition toward utilizing proxy servers for command-and-control traffic, as noted in the updated advisory, indicates that the attackers are already adapting to increased scrutiny. The resilience of this campaign serves as a critical reminder that for journalists and activists, digital hygiene is no longer a matter of convenience, but a fundamental component of personal safety. The ongoing cooperation between the U.S., U.K., and Dutch agencies represents a vital effort to disrupt these networks and safeguard the freedom of speech for those who operate in the crosshairs of state intelligence services.