A recent alert from the Federal Bureau of Investigation (FBI) has revealed a growing cybersecurity threat involving Iranian hackers leveraging the popular messaging platform Telegram to carry out sophisticated malware attacks. These attacks are reportedly targeting dissidents, journalists, and opposition groups worldwide who oppose the Iranian regime.
How the Attack Works
According to the FBI, the attack unfolds in two key stages. First, hackers initiate contact by impersonating trusted individuals or posing as technical support. Victims are then tricked into clicking malicious links disguised as legitimate apps like WhatsApp or Telegram itself.
Once the victim installs the infected file, malware is deployed onto their device. In the second stage, the compromised system connects to Telegram bots, which act as command-and-control centers. This allows attackers to remotely access the device, steal sensitive files, capture screenshots, and even record video calls, including Zoom meetings.
Why Telegram Is Being Used
Cybercriminals are increasingly using Telegram because it helps mask malicious activity within normal network traffic. This makes it harder for traditional cybersecurity tools to detect unusual behavior, giving attackers a significant advantage.
Alleged Iranian Government Involvement
The FBI believes these operations are linked to Iran’s Ministry of Intelligence and Security (MOIS). The attacks are seen as part of a broader effort to advance Iran’s geopolitical agenda through cyber espionage.
The report also mentions the hacktivist group “Handala,” suspected to be a front for Iranian intelligence. The group recently claimed responsibility for a major cyberattack on Stryker, which disrupted thousands of employee devices.
