**Iranian State-Sponsored Hackers Use Telegram as Command-and-Control Infrastructure for Malware Attacks**

In a disturbing trend that highlights the increasing sophistication of state-sponsored hacking groups, Iranian Ministry of Intelligence and Security (MOIS) actors have been using the popular messaging app Telegram as a command-and-control infrastructure to spread malware targeting dissidents and journalists worldwide. This alarming tactic enables surveillance, data theft, and reputational damage against victims, underscoring the need for heightened cybersecurity awareness and vigilance.

According to a recent alert from the Federal Bureau of Investigation (FBI), Iranian MOIS actors have employed multiple malware variants since late 2023 to target Windows systems linked to dissidents, journalists, and opposition groups. These attacks are part of ongoing Iranian cyber operations amidst rising geopolitical tensions in the Middle East.

The FBI warns that attackers rely on social engineering tactics to disguise malware as legitimate software, deploying multi-stage payloads that connect infected devices to Telegram-based command-and-control infrastructure. This allows remote access, screen capture, and data theft, providing hackers with long-term control over compromised systems.

**Malware Infection Chain: A Step-by-Step Guide**

The FBI analyzed the malware used in Iranian-linked campaigns and identified a multi-stage infection chain:

1. **Initial Malware Deployment**: Attackers disguise themselves as trusted contacts or support staff to convince victims to download masquerading malware, which appears as legitimate apps like Telegram, KeePass, or WhatsApp. 2. **Persistent Implant Installation**: Once executed, the initial malware installs a persistent implant (stage 2) that connects to a Telegram-based command-and-control system, enabling two-way communication with infected devices.

**Key Takeaways**

* Iranian MOIS actors are using Telegram as a C2 infrastructure for malware attacks, highlighting the app's vulnerability to exploitation. * Social engineering tactics are employed to convince victims to download malicious files, often tailored to their behavior and pattern of life. * Malware enables surveillance, data theft, and reputational damage against victims, supporting Iran's broader geopolitical goals.

**Mitigation Measures**

To reduce the risk of compromise, organizations and individuals should:

1. **Exercise Caution with Unexpected Messages**: Be wary of unexpected or unusual messages, even from known contacts. 2. **Keep Devices Updated**: Ensure devices are running the latest software versions and security patches. 3. **Verify Software Sources**: Only download software from trusted sources to prevent malware infection. 4. **Use Antivirus Tools**: Install reputable antivirus tools and enable strong passwords with MFA. 5. **Report Suspicious Activity**: Immediately report suspicious activity to providers or authorities.

The use of Telegram as a command-and-control infrastructure for malware attacks highlights the need for ongoing cybersecurity awareness and education. By understanding these tactics, we can better protect ourselves against state-sponsored hacking groups and their sophisticated attacks.

**Stay Informed**

Follow me on Twitter: @securityaffairs and Facebook and Mastodon for the latest news and updates on cybersecurity threats and research.

By staying vigilant and informed, we can work together to mitigate the risks associated with these types of attacks and maintain a safer online environment.