Iran's MOIS Runs Its Spyware Through a Telegram Bot, One Bot Per Victim

The file looked like MRI scan results. Other times it looked like KeePass, or Norton Antivirus, or the AI video tool Pictory, or Telegram itself. The target opened it, a convincing screen appeared, and in the background a second stage quietly wired the machine to a Telegram bot that could read their mail, copy their WhatsApp and Telegram data out of the browser, photograph the screen, and switch on the microphone. On September 15, 2026, the UK's NCSC, the FBI, and the Netherlands' AIVD put a name to it: HEAVYGRAM to the Bureau, CHOSEN BRICK to the NCSC, and the work of Iran's Ministry of Intelligence and Security either way.

The stakes here are not quarterly revenue. The agencies say the targets are mainly Iranian dissidents, journalists who oppose Iran, activists, and members of groups whose views clash with the government, hit in the UK, the US, the Netherlands, and elsewhere since at least 2025, as part of a campaign the FBI dates to the autumn of 2023. Screenshots and collected files reveal contacts, location, and daily routine. The personal details of some victims have already turned up on pro-Iranian leak sites. In March, the US Justice Department seized four of those sites, which it said were used to post stolen data and to call for the killing of dissidents and journalists. The advisory notes that Iranian intelligence services have, in some cases, plotted to kidnap or kill people abroad. This is surveillance with a body count attached to the far end of it.

The work laptop is the beachhead, and your success is the pivot

Read this line from the advisory twice, because it is the part that belongs to IT managers rather than to human rights desks: the attackers often start on a target's work computer, and if that does not succeed, they move to a personal device, which company security does not protect. The approach is patient social engineering. They pose as someone the target already knows, or as tech support for a messaging app, and build trust before the file ever arrives. Your EDR holding the line is not the end of the engagement. It is the signal that tells MOIS to go after the same person on the laptop you cannot see.

What the implant actually does

Every version seen so far is Windows only. Once running, operators can tell it to:

• List running programs and take screenshots on demand
• Activate the microphone and record audio
• Copy Telegram and WhatsApp data out of the browser
• Steal saved passwords and email addresses
• Download additional malware, delete files, and in at least one version, wipe the computer

Persistence is unglamorous: a Windows registry Run key entry named SMQDService or winappx, so it restarts at every logon. It then instructs Microsoft Defender to skip certain folders so its own files go unscanned, and drops extras into a folder whose name carries a trailing space, C:\Windows \SysWOW64, which reads as the real system path to a tired analyst. Each infected machine gets its own Telegram bot, which the agencies say keeps one victim's activity from mixing with another's. Stolen files leave through that bot and through cloud storage including Vultr and Storj, and newer builds push their Telegram traffic through proxies to hide it. The agencies have not seen it spread across a network on its own.

The RedEye take

Technically, this is a boring implant. No zero-day, no worming, no clever in-memory gymnastics. A Run key, a Defender exclusion, and a chat bot. That is the point, and it should bother you more than a flashy exploit chain would. MOIS does not need an expensive capability because the attack surface is a person under pressure who receives a file from someone they believe they know. The tradecraft budget went into the pretext, not the payload.

The per victim Telegram bot is the detail worth sitting with. It kills the infrastructure pivot that most threat intel programs are built around. There is no shared C2 IP to enumerate, no hosting provider to burn, no single domain to sinkhole, because the C2 is api.telegram.org and so is half the legitimate traffic on the internet. Blocking that domain outright is the single highest value control available here, and it is the control most organizations will refuse to apply because Telegram is also how their staff talk to sources. That is a policy decision, not a technical one, and it should be made deliberately by a named person rather than by default. Meanwhile the other half of the problem is outside your console entirely: newsrooms, universities, NGOs, and diaspora organizations employ the exact people MOIS is hunting, and when the corporate build holds, the attacker walks over to a personal Windows machine that has no telemetry, no allowlist, and no one watching it.

What defenders should learn

• Treat a Defender exclusion change as an intrusion alert, not a helpdesk event. This malware adds its own exclusion path, so Windows Defender operational Event ID 5007 on an endpoint where no admin filed a ticket is a high fidelity signal that almost nobody alerts on.
• Alert on the process, not the domain. Any image other than the signed Telegram client resolving api.telegram.org is anomalous, and Sysmon Event ID 22 gives you the QueryName and Image fields to say so without blocking Telegram for your journalists.
• Search your allowlists and detection rules for trailing space path tricks. C:\Windows \SysWOW64 defeats naive prefix matching on C:\Windows\ and defeats human eyeballs in a console. Normalize paths before you compare them.
• Publish a standing list of what IT will and will never send. Norton Antivirus and KeePass were both used as lures. If your users know that security software never arrives as a file in a chat, the pretext dies before the payload runs.
• Give your high risk staff a hardened personal option. The advisory is explicit that the attackers move to the unmanaged device when the managed one resists. A spare locked down laptop or a funded managed device for a threatened reporter is cheaper than the incident, and it is the only control that covers the pivot.

The agencies present their conclusions as assessments rather than as matters settled in court, and that framing is worth preserving when you brief your own leadership. When the FBI first described this campaign in March 2026, Telegram told TechCrunch that its moderators routinely remove any accounts found to be involved with malware. The September 15 joint advisory, and the FBI's updated analysis with new indicators of compromise, suggest that removal has not been fast enough to change the economics. Reported by Swati Khandelwal for The Hacker News, September 15, 2026: https://thehackernews.com/2026/09/iranian-hackers-use-telegram-controlled.html

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"

powershell -NoProfile -Command "Get-MpPreference | Select-Object -ExpandProperty ExclusionPath"

powershell -NoProfile -Command "Get-ChildItem -LiteralPath 'C:\Windows \SysWOW64' -Force -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime"

reg export "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" "%USERPROFILE%\Desktop\run-key-backup.reg"
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SMQDService /f

powershell -NoProfile -Command "Remove-MpPreference -ExclusionPath 'C:\Windows \SysWOW64'"
powershell -NoProfile -Command "Start-MpScan -ScanType FullScan"

powershell -NoProfile -Command "New-Item -ItemType Directory -Force -Path 'C:\Quarantine'"
powershell -NoProfile -Command "Move-Item -LiteralPath 'C:\Windows \SysWOW64' -Destination 'C:\Quarantine\syswow64-suspect' -Force -ErrorAction SilentlyContinue"