MalwareUsed by 2 actors

HEAVYGRAM

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

MOIS

The FBI assesses that Iranian cyber actors are using HEAVYGRAM malware to conduct malicious cyber activity to target Iranian dissidents, journalists opposed to Iran, and other opposition groups around the world on behalf of the Government of Iran’s Ministry of Intelligence and Security (MOIS).

via ic3 alertsic3.gov

Iranian Ministry of Intelligence and Security (MOIS)

The FBI calls it HEAVYGRAM, and the U.K.'s National Cyber Security Center (NCSC) calls it CHOSEN BRICK. The malware is controlled via Telegram and can copy emails and chat messages, take screenshots, activate the microphone, steal credentials, download additional malware, and in at least one version wipe the computer.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1566PhishingEvidence1

MOIS cyber actors used social engineering via social media platforms such as Telegram, WhatsApp, and Instagram to communicate with victims while offering IT services.

T1566.001Spearphishing AttachmentEvidence1

The attackers pose as someone the target knows or as tech support for a messaging app, building trust before sending a file that appears to be a legitimate program.

T1566.003Spearphishing via ServiceEvidence1

The attack begins with a message. The attackers pose as someone the target knows or as tech support for a messaging app.

Execution

1 technique

T1204.002Malicious FileEvidence2

Victims would... download a malware file masquerading as a program installer that the victim used which started a chain of infection.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

To survive a restart, the malware adds itself to a Windows registry 'Run' key, so it starts again each time the user logs in.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

To survive a restart, the malware adds itself to a Windows registry 'Run' key, so it starts again each time the user logs in.

Stealth

2 techniques

T1036MasqueradingEvidence2

Reported disguises include the AI video app Pictory, the password manager KeePass, Telegram itself, RunwayML, Norton Antivirus, and Adobe Flash Player. In some cases, the file was made to look like MRI scan results.

T1070.004File DeletionEvidence1

Once running, the malware can be told to do many things: ... delete files.

Credential Access

1 technique

T1555.003Credentials from Web BrowsersEvidence1

Once running, the malware can be told to ... copy Telegram and WhatsApp data from the browser, [and] steal saved passwords and email addresses.

Discovery

1 technique

T1057Process DiscoveryEvidence1

Once running, the malware can be told to do many things: list running programs.

Collection

3 techniques

T1005Data from Local SystemEvidence1

The malware ... can copy a target's emails and chat messages ... [and] delete files.

T1113Screen CaptureEvidence1

The malware ... can copy a target's emails and chat messages, take screenshots, and activate the microphone to record audio.

T1123Audio CaptureEvidence1

The malware ... can ... activate the microphone to record audio.

Command and Control

3 techniques

T1090ProxyEvidence1

Newer versions send their Telegram traffic through proxy servers to hide it.

T1102.002Bidirectional CommunicationEvidence2

get_update sends POST request to https://api.telegram.org/bot<token>/getUpdates... analyze_command()... execute C2 command... send_msg(), send_file(), and send_screenshot send results to Telegram.

T1105Ingress Tool TransferEvidence1

Once running, the malware can be told to ... download additional malware.

Exfiltration

1 technique

T1567.002Exfiltration to Cloud StorageEvidence1

Stolen files leave the computer through the Telegram bot and through cloud storage services such as Vultr and Storj.

Impact

1 technique

T1561.002Disk Structure WipeEvidence1

At least one version can also wipe the computer, according to the joint advisory.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

It also tells Microsoft Defender, the built-in antivirus, to skip certain folders so its files are not scanned.

INDICATORS OF COMPROMISE

IOCs tracked for this family

75 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

24 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

42 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

9 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mkd cirtNews

Sep 16, 2026

Ирански хакери користат malware контролиран преку Telegram за шпионирање дисиденти и новинари | MKD-CIRT | Национален центар за одговор на компјутерски инциденти

A Windows-focused Iranian intelligence espionage implant attributed by the FBI to Iran's Ministry of Intelligence and Security (MOIS). It is delivered through impersonation and trojanized-looking application files, establishes persistence through a Registry Run key, attempts to exclude its files from Microsoft Defender scanning, and uses a victim-specific Telegram bot for command-and-control and data exfiltration. Capabilities include surveillance, credential and email-address theft, file deletion, additional-payload download, and, in at least one variant, complete system wiping.

the hacker newsNews

Sep 15, 2026

Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists

Windows-targeting espionage malware operated through per-victim Telegram bots. It uses masqueraded application installers and a fake user interface to install in the background, establishes persistence through Windows Run registry keys, excludes its files from Microsoft Defender scanning, and exfiltrates collected data through Telegram and cloud-storage services. It supports surveillance, credential and browser-data theft, command execution/download of further tools, file deletion, and potentially disk wiping.

ic3 alertsNews

Sep 15, 2026

Modular Windows surveillance and persistent-implant malware cluster delivered through social engineering. It uses Telegram as C2 and Vultr S3 for staging/exfiltration; it can conduct reconnaissance, execute commands, steal browser, Telegram, WhatsApp, and Outlook data, capture screenshots, access removable/MTP devices, and deploy further surveillance components.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching75

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 2 actors

HEAVYGRAM

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

MOIS

via ic3 alertsic3.gov

Iranian Ministry of Intelligence and Security (MOIS)

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1566PhishingEvidence1

MOIS cyber actors used social engineering via social media platforms such as Telegram, WhatsApp, and Instagram to communicate with victims while offering IT services.

T1566.001Spearphishing AttachmentEvidence1

The attackers pose as someone the target knows or as tech support for a messaging app, building trust before sending a file that appears to be a legitimate program.

T1566.003Spearphishing via ServiceEvidence1

The attack begins with a message. The attackers pose as someone the target knows or as tech support for a messaging app.

Execution

1 technique

T1204.002Malicious FileEvidence2

Victims would... download a malware file masquerading as a program installer that the victim used which started a chain of infection.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

To survive a restart, the malware adds itself to a Windows registry 'Run' key, so it starts again each time the user logs in.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

To survive a restart, the malware adds itself to a Windows registry 'Run' key, so it starts again each time the user logs in.

Stealth

2 techniques

T1036MasqueradingEvidence2

T1070.004File DeletionEvidence1

Once running, the malware can be told to do many things: ... delete files.

Credential Access

1 technique

T1555.003Credentials from Web BrowsersEvidence1

Once running, the malware can be told to ... copy Telegram and WhatsApp data from the browser, [and] steal saved passwords and email addresses.

Discovery

1 technique

T1057Process DiscoveryEvidence1

Once running, the malware can be told to do many things: list running programs.

Collection

3 techniques

T1005Data from Local SystemEvidence1

The malware ... can copy a target's emails and chat messages ... [and] delete files.

T1113Screen CaptureEvidence1

The malware ... can copy a target's emails and chat messages, take screenshots, and activate the microphone to record audio.

T1123Audio CaptureEvidence1

The malware ... can ... activate the microphone to record audio.

Command and Control

3 techniques

T1090ProxyEvidence1

Newer versions send their Telegram traffic through proxy servers to hide it.

T1102.002Bidirectional CommunicationEvidence2

get_update sends POST request to https://api.telegram.org/bot<token>/getUpdates... analyze_command()... execute C2 command... send_msg(), send_file(), and send_screenshot send results to Telegram.

T1105Ingress Tool TransferEvidence1

Once running, the malware can be told to ... download additional malware.

Exfiltration

1 technique

T1567.002Exfiltration to Cloud StorageEvidence1

Stolen files leave the computer through the Telegram bot and through cloud storage services such as Vultr and Storj.

Impact

1 technique

T1561.002Disk Structure WipeEvidence1

At least one version can also wipe the computer, according to the joint advisory.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

It also tells Microsoft Defender, the built-in antivirus, to skip certain folders so its files are not scanned.

INDICATORS OF COMPROMISE

IOCs tracked for this family

75 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

24 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

42 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

9 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists

ic3 alertsNews

Sep 15, 2026

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching75

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.