Actor Profile

Iranian state-linked threat actors conducting espionage operations targeting dissidents, activists, and journalists globally. The activity is attributed to Iranian intelligence services and is assessed to support regime repression efforts against perceived threats. The actors leverage social engineering via messaging platforms and deploy custom surveillance malware to collect communications and conduct long-term monitoring. Government agencies assess Iran almost certainly uses cyber activity to support repression of individuals seen as threats to the regime, with some cases involving plots to kidnap or conduct lethal operations against targets internationally.

TTPs (Tactics, Techniques, Procedures)

Initial access via social engineering on WhatsApp and Telegram, impersonating trusted contacts or technical support (T1566 - Phishing). Malicious files disguised as legitimate applications including Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass. Persistence established through Windows Registry Run keys (T1547.001 - Registry Run Keys / Startup Folder). Defense evasion by adding Microsoft Defender exclusions (T1562.001 - Impair Defenses: Disable or Modify Tools). Command and control via unique Telegram bots per victim and SOCKS5 proxies (T1090 - Proxy, T1102 - Web Service). Collection capabilities include system information enumeration (T1082), process discovery (T1057), screen capture (T1113), audio capture (T1123), email collection, and browser credential theft targeting Telegram and WhatsApp data (T1005 - Data from Local System). Exfiltration through Telegram API and cloud services including VultrObjects, StorjShare, and Backblaze B2 (T1567 - Exfiltration Over Web Service). Additional capabilities include downloading payloads, file deletion, and full system wiping (T1485 - Data Destruction).

Targets & Patterns

Primary targets are dissidents, activists, and journalists perceived as threats to the Iranian regime. Geographic focus includes the United States, United Kingdom, and the Netherlands, though operations are assessed to be global in scope. Targeted sectors include government, civil society organizations, and media. The threat actor employs tailored social engineering lures, including medical-themed pretexts such as MRI scan documents, to increase victim engagement. Stolen data is sometimes published on pro-Iranian leak sites as a form of harassment and to increase physical risk for dissidents abroad. The targeting pattern aligns with Iranian state intelligence priorities to monitor and suppress opposition voices internationally, with government agencies noting that Iranian intelligence services have plotted kidnapping and lethal operations against perceived enemies of the regime.

Historical Context

This campaign represents continued Iranian state-sponsored cyber espionage targeting dissidents and opposition figures, consistent with Iran's documented pattern of using cyber operations to support regime repression. The joint advisory from U.S., U.K., and Dutch cybersecurity agencies alongside the FBI indicates coordinated international concern about Iranian transnational repression activities. The use of Telegram for both initial contact and command-and-control infrastructure reflects Iranian actors' adaptation to platforms commonly used by target populations. Publication of stolen data on pro-Iranian leak sites demonstrates integration of cyber operations with broader information operations and intimidation campaigns against diaspora communities.

Defensive Recommendations

  • Monitor Windows Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM equivalents) for suspicious entries associated with CHOSEN BRICK persistence (T1547.001)
  • Detect and alert on unexpected connections to Telegram API endpoints, particularly bot API traffic, as well as connections to VultrObjects, StorjShare, Backblaze B2, IPRoyal, and LightningProxies infrastructure
  • Implement application whitelisting and scrutinize executables masquerading as legitimate software (Pictory, RunwayML, Norton, Telegram, Adobe Flash Player, KeePass) to prevent initial execution
  • Monitor for automated addition of Microsoft Defender exclusions via PowerShell or command-line (T1562.001), particularly exclusions targeting user directories or system folders like C:\Windows\SysWOW64
  • Educate high-risk users (activists, journalists, dissidents) on social engineering tactics via WhatsApp and Telegram, emphasizing verification of sender identity and risks of running applications outside corporate environments