Iran MOIS Deploys Telegram-Bot C2 Malware HEAVYGRAM/CHOSEN BRICK Against Dissidents Since 2023

The malware arrives via spear-phishing disguised as legitimate apps including Pictory, KeePass, and Norton. A first-stage loader drops a second stage that registers a unique Telegram bot for each victim, persists via registry Run keys, and evades Defender by excluding its directories. It supports screenshot capture, microphone activation, browser credential theft from Telegram and WhatsApp, and selective file deletion or full wipe. Exfiltration routes through the same bots plus Vultr and Storj storage. Joint NCSC-FBI-AIVD advisory of 15 September 2026 expands the March FBI alert with new samples and confirms targeting in the UK, US, and Netherlands since at least 2025. Technical evidence consists of consistent C2 infrastructure, shared code strings, and victim telemetry; attribution to MOIS rests on infrastructure overlap and targeting patterns rather than independent third-party verification. The campaign fits a documented MOIS pattern of blending cyber collection with physical threat operations against expatriates. Use of consumer messaging apps for C2 reduces infrastructure cost and attribution surface while enabling rapid tasking. Data aggregation on pro-Iran leak sites after collection increases real-world risk to named individuals. Future variants are expected to target macOS and mobile endpoints as Windows-only restrictions limit reach. Defenders should monitor for anomalous Telegram process behavior and registry modifications on high-risk user systems through 2027.