Actor Profile

Iran's Ministry of Intelligence and Security (MOIS), the country's primary intelligence agency, is attributed by the FBI, UK NCSC, and Netherlands AIVD as the operator behind this espionage campaign. Active since autumn 2023, MOIS leverages custom Windows malware (HEAVYGRAM/CHOSEN BRICK) controlled via Telegram bots to conduct surveillance operations against individuals perceived as threats to the Iranian government. The actor's motivation is transnational repression: suppressing dissent, monitoring opposition figures, and collecting intelligence on Iranian dissidents, journalists, activists, and members of groups whose views conflict with the regime. The agencies note that Iran has previously used cyber-derived intelligence to support physical operations, including plots to kidnap or kill targets abroad.

TTPs (Tactics, Techniques, Procedures)

Initial access is achieved via social engineering (T1566.001 Spearphishing Attachment), with attackers impersonating trusted contacts or tech support and delivering malicious files disguised as legitimate applications (Pictory, KeePass, Telegram, Norton, Adobe Flash, MRI scans). The malware establishes persistence through Windows Registry Run keys (T1547.001 Registry Run Keys / Startup Folder) and evades detection by adding exclusions to Microsoft Defender (T1562.001 Impair Defenses: Disable or Modify Tools). Command and control is conducted via Telegram bot infrastructure (T1102.002 Application Layer Protocol: Web Protocols), with newer variants using proxy services (iproyal.com, lightningproxies.net) for obfuscation. Collection capabilities include screen capture (T1113 Screen Capture), audio recording via microphone (T1123 Audio Capture), credential harvesting from browsers (T1555.003 Credentials from Password Stores: Credentials from Web Browsers), and exfiltration of Telegram/WhatsApp data. Exfiltration occurs through Telegram bots and cloud storage services including Vultr, Storj, and Backblaze B2 (T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage). At least one variant includes disk-wiping functionality (T1485 Data Destruction).

Targets & Patterns

Primary targets are Iranian dissidents, journalists critical of the Iranian government, activists, and members of organizations opposing the regime, located in the United States, United Kingdom, Netherlands, and globally. The FBI warns that anyone Iran considers of interest could be targeted. The targeting pattern reflects Iran's transnational repression strategy, using cyber espionage to identify, monitor, and potentially endanger opposition figures abroad. Attackers initially attempt compromise of work computers, then pivot to personal devices if corporate security blocks initial access. Collected data—including screenshots revealing contacts, location, and daily routines—has been weaponized through publication on pro-Iranian leak sites, which the US Justice Department seized four of in March 2026. These leaks have included calls for violence against victims, directly escalating physical risk. The campaign demonstrates systematic targeting of civil society and media sectors to suppress dissent and gather intelligence supporting potential kinetic operations against diaspora communities.

Historical Context

The FBI's September 2026 advisory expands on an initial March 2026 alert that first disclosed the campaign, adding technical detail and new indicators of compromise. The campaign itself dates to autumn 2023, with confirmed CHOSEN BRICK/HEAVYGRAM activity against targets in the UK, US, and Netherlands observed since at least 2025. In March 2026, the US Justice Department seized four Iranian leak sites used to publish stolen victim data and incite violence against dissidents and journalists, indicating coordination between MOIS cyber operations and influence/intimidation campaigns. The advisory notes that Iranian intelligence services have previously plotted kidnapping and assassination operations against targets abroad, suggesting this malware campaign feeds into broader transnational repression efforts. The use of Telegram for C2 and the focus on messaging app data collection reflects Iran's continued interest in monitoring encrypted communications of opposition figures.

Defensive Recommendations

  • Monitor Windows Registry Run keys (HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run) for suspicious entries named 'SMQDService' or 'winappx' that may indicate T1547.001 persistence mechanisms
  • Inspect file system for anomalous directories with trailing spaces (e.g., 'C:\Windows \SysWOW64') and mutex objects with names matching patterns 'ytyjyujyu' or 'noi672pp434awkc12f'
  • Implement network monitoring for unexpected connections to api.telegram.org, vultrobjects.com, storjshare.io, backblazeb2.com, iproyal.com, and lightningproxies.net from endpoints not authorized to use these services
  • Deploy phishing-resistant multi-factor authentication and application allowlisting to prevent execution of social engineering payloads disguised as legitimate software (T1566.001)
  • Enable and monitor Microsoft Defender exclusion changes via event logs to detect T1562.001 defense evasion attempts, and enforce user training to reject unsolicited files from messaging apps regardless of apparent sender identity

---

# Geopolitical Context

Geopolitical Context

The disclosure of HEAVYGRAM/CHOSEN BRICK malware by US, UK, and Dutch cybersecurity agencies represents a coordinated Western effort to expose Iranian transnational repression operations in the digital domain. The campaign, attributed to Iran's Ministry of Intelligence and Security (MOIS) and active since at least autumn 2023, reflects Tehran's systematic use of cyber capabilities to monitor and suppress diaspora communities, independent journalists, and activists whose views challenge the Islamic Republic's authority. The targeting pattern—focused on Iranian dissidents and opposition voices globally—is consistent with Iran's documented history of extraterritorial intimidation, including plots to kidnap or kill perceived threats abroad. The use of Telegram, an encrypted messaging platform popular among Iranian civil society, as both lure and command infrastructure demonstrates operational sophistication and exploitation of trusted communication channels. The joint advisory's publication in September 2026, following an initial FBI alert in March 2026 and the US Justice Department's seizure of four Iranian leak sites, indicates sustained Western intelligence community focus on Iranian cyber-enabled repression. The timing may also reflect broader geopolitical tensions between Iran and Western powers, though the advisory frames the threat primarily through a human rights and transnational repression lens rather than traditional state-versus-state cyber conflict.

State Actor Alignment

The malware is formally attributed by the FBI to Iran's Ministry of Intelligence and Security (MOIS), the country's principal civilian intelligence agency. This represents a high-confidence attribution by multiple Western intelligence and cybersecurity agencies—the FBI, UK National Cyber Security Centre (NCSC), and Netherlands' AIVD—acting in coordination. The attribution is notable for its directness, naming a specific Iranian state institution rather than using proxy or front-group framing. The campaign aligns with Iran's documented pattern of using cyber operations as an instrument of domestic security policy extended beyond its borders, targeting individuals the regime perceives as existential threats to its stability. The March 2026 seizure of four Iranian leak sites by the US Justice Department, which reportedly hosted stolen data and incitement to violence against dissidents, suggests US law enforcement views this activity as crossing thresholds that warrant direct action. The multi-country disclosure may also serve as a coordinated signaling effort, intended to impose reputational costs on Tehran and complicate its operational security by exposing tradecraft. No sanctions are mentioned in the available reporting, though such disclosures often precede or accompany broader policy responses.

Business Impacty pro region

For Europe, the campaign underscores the challenge of protecting diaspora communities and civil society actors on European soil from authoritarian state cyber operations. The UK and Netherlands' direct involvement in the advisory reflects their roles as host countries to significant Iranian dissident populations and their exposure to transnational repression threats. The disclosure may prompt European governments to strengthen protective measures for at-risk individuals and to consider diplomatic or sanctions responses, particularly if evidence emerges of operations targeting their nationals or residents. Globally, the campaign illustrates the growing use of commercial and consumer technologies—Telegram bots, cloud storage providers like Vultr and Storj, and proxy services—as dual-use infrastructure for state intelligence operations, complicating platform governance and content moderation debates. For the Middle East, the operation reinforces perceptions of Iran's willingness to pursue perceived adversaries beyond its borders, potentially chilling diaspora activism and independent journalism. The advisory's emphasis on physical safety risks—noting that stolen data has appeared on leak sites calling for violence—may heighten security concerns among Iranian civil society networks worldwide. The coordinated Western response also signals continued intelligence-sharing and operational alignment among the US, UK, and European partners on Iran-related threats, despite broader geopolitical shifts.

Forecast

If Western governments maintain focus on Iranian transnational repression, further public attributions and potential sanctions designations targeting MOIS personnel or associated infrastructure are likely in the coming months. If Iran perceives the disclosure as a significant operational setback, MOIS may shift to alternative command-and-control methods or platforms, though Telegram's popularity among target communities may limit viable substitutes. If diaspora and civil society organizations adopt the recommended defensive measures—particularly around social engineering awareness and endpoint security—the campaign's effectiveness may diminish, though highly targeted individuals are likely to remain at elevated risk. If the US and European partners expand their focus on platform and cloud service provider cooperation, we may see increased takedowns of malicious bots and infrastructure, though attribution and jurisdiction challenges will persist. If broader US-Iran tensions escalate—whether over nuclear negotiations, regional proxy conflicts, or sanctions enforcement—cyber-enabled repression campaigns may intensify as Tehran seeks to preempt or retaliate against perceived threats. Conversely, if diplomatic engagement increases, cyber operations targeting dissidents may continue largely unaffected, as Tehran views domestic security and regime preservation as non-negotiable interests insulated from broader diplomatic trade-offs.