The FBI has issued a new alert warning that Iranian state-linked threat actors are using Telegram as command-and-control (C2) infrastructure in targeted cyberattacks.
This campaign highlights a growing trend in modern cyber warfare:
Legitimate communication platforms are increasingly being weaponized to control malware and conduct espionage.
Who is being targeted?
The attacks primarily focus on high-risk individuals and groups, including:
- Journalists critical of the Iranian government
- Iranian dissidents
- Political activists and opposition groups
- Targets worldwide with geopolitical relevance
How the attacks work
The campaign relies heavily on social engineering, rather than exploiting software vulnerabilities.
Victims are tricked into:
- Downloading malicious files
- Opening infected attachments
- Installing seemingly legitimate software
Once infected, the malware enables attackers to:
- 📸 Capture screenshots
- 📁 Exfiltrate sensitive files
- 🕵️ Monitor victim activity
Telegram as command-and-control (C2)
Instead of traditional infrastructure, attackers are leveraging Telegram to:
- Send commands to infected devices
- Receive stolen data
- Maintain persistent access
This approach provides several advantages:
- ✔️ Trusted and widely used platform
- ✔️ Encrypted communication channels
- ✔️ Harder to detect and block
However, Telegram has stated that it removes accounts involved in malicious activity when identified.
Threat actors involved
The FBI has linked this activity to multiple Iranian-aligned groups:
- Handala (Handala Hack Team / Hamsa / Hatef)
- Homeland Justice (linked to Iran’s IRGC)
- Additional actor: Karma Below
These groups operate as part of broader state-sponsored cyber operations.
Recent developments
The warning comes amid increased geopolitical tensions and follows:
- FBI seizure of multiple domains used for:
- Data leaks
- Attack infrastructure
- Propaganda
- A major cyberattack by Handala targeting Stryker, where attackers:
- Compromised admin accounts
- Issued remote wipe commands via Microsoft Intune
- Reset ~80,000 devices (including employee devices)
A broader trend
This campaign is part of a larger shift in cyber threats:
👉 Messaging platforms (Telegram, Signal, WhatsApp) are increasingly used for:
- Malware control
- Phishing campaigns
- Data exfiltration
- Covert communication
The FBI recently warned about Russian-linked phishing campaigns targeting messaging apps — showing that this tactic is being adopted globally.
How to stay protected
1. Be cautious with unsolicited messages
Even on trusted platforms like Telegram
2. Avoid downloading unknown files
Especially from unexpected contacts or sources
3. Monitor endpoint activity
Look for unusual outbound connections or data transfers
4. Restrict application usage
Limit which apps can run in sensitive environments
5. Educate users
Social engineering remains the primary attack vector
Key takeaway
This campaign reinforces a critical reality:
Cybersecurity is no longer just about blocking malware — it’s about understanding how trusted platforms are abused.
Attackers don’t need to break systems when they can simply blend into normal communication channels.
