Quick Takeaways
- Iran-backed malware, controlled via Telegram, can spy on victims by copying emails, chats, taking screenshots, and activating microphones, primarily targeting dissidents, journalists, and activists globally.
- The malware disguises itself as legitimate files from trusted apps, installs via social engineering, and persists through registry entries, enabling continuous surveillance and data theft.
- Indicators of compromise include suspicious registry keys, file paths, network connections to specific services, and unique process mutexes, which defenders should monitor to detect infections.
The Threat, Attack Techniques, and Targets
Cybersecurity agencies from the US, UK, and Netherlands have identified a malware used by Iran’s intelligence agency. The malware is called HEAVYGRAM or CHOSEN BRICK. It is designed for Windows computers. The malware allows hackers to spy on dissidents, journalists, and activists worldwide. The attack starts when the hacker sends a fake message to the target. The message may pretend to be from someone the target trusts or a tech support team. Then, the hacker sends a file that looks like a normal program. When the target opens the file, the malware installs quietly in the background.
The malware can copy emails and chat messages, take screenshots, and activate the microphone. It can also steal saved passwords, download extra malicious tools, or delete files. Each infected device has its own Telegram bot, which helps control the malware. The hackers often use fake files disguised as apps like Pictory, KeePass, or even MRI scan results. This attack mainly targets Iranian dissidents, opposing journalists, activists, and people whose views challenge the Iranian government. However, anyone considered as a threat by Iran could become a target.
Impact, Security Implications, and Remediation Guidance
The malware poses serious risks beyond just stolen data. It can reveal a person’s contacts, location, and daily habits. Personal information collected can be shared on leak sites, increasing threats to victims’ safety. Evidence shows that Iran may use such cyber activity to suppress opponents and even plan kidnappings or killings abroad.
The malware works by disguising itself as legitimate files and establishing secret connections through Telegram. It can hide in Windows registry keys, files, and network traffic. Signs of infection include unusual registry entries, hidden files, unexpected network connections, and specific marker names. The malware can be difficult to detect without careful monitoring.
To reduce the risk, individuals should avoid opening files sent via messages. Software should only be downloaded from official sources. Keeping devices updated and running antivirus programs is also important. Network administrators should enforce multi-factor authentication, monitor network activity, and search logs for warning signs. If infection is suspected, users should check their registry, notify their IT support, and report to the appropriate cyber authorities. Specific removal instructions are not provided here; therefore, guidance should be obtained from security vendors or official sources.
Continue Your Tech Journey
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
