Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists
-
Cybersecurity agencies from the United States, the United Kingdom, and the Netherlands have jointly detailed a Windows malware attributed to Iran's intelligence service. According to the advisory, the tool is used to spy on dissidents, journalists, and activists worldwide.
The malware stands out for its command-and-control mechanism: it is controlled through the Telegram messaging app rather than traditional infrastructure. Once deployed on a Windows system, its capabilities include:
- Copying the target's emails and chat messages
- Taking screenshots
- Activating the microphone to record audio
The joint advisory underscores the continued targeting of civil society figures by state-sponsored actors, with Telegram abuse giving operators a low-profile channel for issuing commands and exfiltrating data.
Source: The Hacker News
Does your organization block or monitor Telegram traffic on endpoints, and would that even help against this threat?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login