Iran's MOIS Turned Telegram Into Malware Command Infrastructure, FBI Warns

A new FBI FLASH alert lays out how Iran-linked operators have spent more than two years hiding malware traffic inside an app hundreds of millions of people already trust.

On March 20, 2026, the FBI published a FLASH bulletin describing a malware campaign it attributes to cyber actors working on behalf of Iran's Ministry of Intelligence and Security, or MOIS.The campaign uses Telegram bots as command-and-control infrastructure, and it's been running since at least the fall of 2023.[1] That's not a typo — this isn't a new discovery. It's a warning that something ongoing has now gotten enough attention, and enough urgency, for the FBI to put its name on it.

What the FBI actually said

The bulletin, numbered FLASH-20260320-001 and marked TLP:CLEAR (meaning it can be shared without restriction), says the campaign targets Iranian dissidents, journalists critical of the Iranian government, and opposition groups around the world.[1] The FBI is careful to note the malware "could be used to target any individual of interest to Iran" — this isn't a narrow, one-off tool built for a single operation.[1]

The timing matters. The FBI says it's highlighting this activity now because of the "elevated geopolitical climate of the Middle East and current conflict."[1] In other words: this campaign predates the current tension, but the current tension is why the FBI decided the public needed to hear about it again, in detail, with indicators attached.

How the malware works

Strip away the branding and the operation is a fairly classic two-stage setup, though the execution is patient and well-targeted. Stage one is a masquerading file — something disguised as a program the victim already wants. The FBI's analysis names four specific examples pulled directly from malware samples: Telegram_authenticator.exe, WhatssApp.exe (note the deliberate misspelling), KeePass.exe, and Pictory_premium_ver9.0.4.exe.[1] None of those are real vendor builds. They're bait.

Once a victim opens the file, stage two kicks off: a persistent implant. This is where the Telegram angle comes in. The FBI's own language is worth quoting directly, because it's precise about what the malware does technically: the implant configures a command-and-control channel using a Telegram bot, giving the attackers two-way communication with the infected machine through api.telegram[.]org.[1]

Why does that matter more than it might sound like on first read? Because Telegram's API traffic is common, encrypted, and completely unremarkable on most corporate or personal networks. A connection to a known, legitimate cloud service doesn't trip the same alarms that a connection to some freshly registered domain would. The attackers aren't exploiting a flaw in Telegram — they're exploiting the fact that blocking Telegram traffic wholesale is impractical for most defenders, and that's enough.

Getting in: the social engineering piece

None of this works without step zero, which is entirely human. The FBI describes attackers reaching out over messaging platforms while posing as someone the victim already knows, or as technical support for the platform itself.[1] They then talk the victim into accepting a file transfer.

What stands out in the FLASH is a specific observation: the bait file appeared tailored to each victim's "pattern of life," which the FBI reads as evidence of prior reconnaissance.[1] This isn't spray-and-pray phishing. Someone did homework on these targets before ever making contact — checking what apps they use, what they'd plausibly expect to receive, maybe what device they're on. That's resource-intensive work, and it points toward a patient, well-funded operation rather than opportunistic criminals.

What the malware actually does once it's in

The FLASH lists five additional executables the FBI recovered during its investigation, tied to data collection and exfiltration: MicDriver.exe/MicDriver.dll, Winappx.exe, MsCache.exe, RuntimeSSH.exe, and smqdservice.exe.[1] Between them, these samples can record the screen, capture audio, pull cached data, compress files with a password, delete files locally, and stage the compressed output for upload back through the Telegram channel.[1]

One detail is genuinely unsettling if you sit with it: the FBI notes that MicDriver included logic to record screen and audio specifically while a Zoom session is active.[1] That's not generic spyware bolted on for good measure. That's a feature built for a specific use case — capturing what someone says and shows during a video call, presumably because video calls are where dissidents and journalists plan, coordinate, and speak candidly with sources or each other.

For persistence, the malware adds a reference to the Windows registry so stage two automatically restarts, and it configures directory exclusions that let PowerShell run without triggering Windows' usual warnings.[1] Both are well-worn techniques — nothing exotic — but they work, especially against a target who isn't running enterprise-grade endpoint monitoring, which describes most individual journalists and activists.

Who's behind it, and how confident should you be about that

The FBI attributes this campaign to actors operating on behalf of Iran MOIS.[1] It also draws a connection to a specific persona: "Handala Hack," which claimed a July 2025 hack-and-leak operation against people who had publicly voiced concerns about events in Iran.[1] The FBI's own wording here is measured — it "assesses" that some of the material Handala Hack posted was obtained through this malware campaign, not that it's confirmed beyond doubt.[1] That distinction is worth preserving rather than flattening into a firmer claim than the FBI itself is making.

Handala Hack is described as known for phishing, data theft, extortion, and destructive wiper attacks, and the FBI further assesses it's linked to another persona called "Homeland Justice," also tied to MOIS cyber actors.[1] Some private threat-intelligence writeups have gone further and layered on additional actor aliases and group names. This article sticks to what the FBI document itself states, since that's the primary, verified source — additional attribution claims from other outlets aren't repeated here unless they're independently corroborated.

It's also worth being honest about what this alert is not. There's no CVE here, no CVSS score, no patch to apply, because this isn't a software vulnerability. It's a description of an ongoing human-operated campaign — TTPs, malware samples, and file hashes the FBI obtained through its own investigations. That's a different, and in some ways stronger, category of evidence than a typical proof-of-concept writeup, since it reflects direct malware analysis rather than inference from public exploit code.

Indicators from the FBI's malware analysis

These hashes come directly from the FBI's published FLASH and are reproduced here without modification.[1]

Who should actually be paying attention

Read narrowly, this alert is about a specific victim set: Iranian dissidents, journalists covering Iran critically, and members of opposition organizations. If that's not you, it's tempting to file this under "not my problem." But the underlying technique — bait files disguised as trusted apps, C2 hidden inside a legitimate messaging platform's API — isn't unique to Iranian operations. It's a template. Organizations that work with at-risk populations (press freedom groups, human rights NGOs, immigration and asylum services) are worth flagging as adjacent risk, even if they weren't named directly in the FLASH.

What defenders and targets should do

The FBI's own recommendations are refreshingly unglamorous, and that's a feature, not a shortcoming. They boil down to: be suspicious of unfamiliar communications even from known contacts, keep operating systems and software patched, only install software from official sources, run antivirus tools regularly, use strong unique passwords with multi-factor authentication enabled, and report anything suspicious to the FBI's field offices or IC3.[1]

For anyone doing sensitive work related to Iran specifically, one practical addition worth stressing beyond the FBI's list: be extra wary of unsolicited file transfers over messaging apps generally, even from accounts that look right. The FBI's reconnaissance finding — that bait was tailored to the victim's habits — means a familiar-looking request isn't automatically safe. If something arrives that you didn't ask for, verify through a second channel before opening it.

Security takeaway

What makes this campaign notable isn't novelty in the technical sense — masquerading installers and registry-based persistence are old techniques. What's notable is the patience and the choice of infrastructure. Using a mainstream messaging platform's own bot API as a C2 channel is a deliberate bet that defenders can't easily distinguish malicious Telegram traffic from the enormous volume of legitimate Telegram traffic. For the specific population this campaign targets — people whose safety may genuinely depend on their devices not being silently watched — that bet has real consequences, and it's why the FBI decided this was worth a fresh warning rather than a filed report.

Sources & References

• [1] Federal Bureau of Investigation — FLASH-20260320-001: "Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets" — March 20, 2026 — View source
• [2] Pierluigi Paganini, Security Affairs — "Iran-linked actors use Telegram as C2 in malware attacks on dissidents" — March 23, 2026 — View source
• [3] HSToday — "Iranian Cyber Actors Using Telegram for Malware Delivery, FBI FLASH Warns" — View source
• [4] CyberInsider — "Telegram Bots Used by Iranian Hackers to Deliver Spyware, FBI Reports" — View source

This article is based on a publicly released, TLP:CLEAR FBI FLASH bulletin. Attribution statements reflect the FBI's own assessed confidence language and are not independently verifiable beyond what the FBI has published.