NCSC, FBI and AIVD warn of Iranian-linked Windows spyware reporting via Telegram bots

Joint advisory names two Iranian-linked spyware families

On 15 September 2026, the UK's National Cyber Security Centre, the FBI and the Dutch intelligence service AIVD released a joint advisory covering two Windows spyware families tied to Iranian intelligence, tracked under the names Chosen Brick and HEAVYGRAM. According to a dev.to write-up of the document, the agencies assess the tooling as having been in use since at least 2025, with the broader campaign running back to autumn 2023.

Infection starts with a social approach

Rather than exploiting software flaws, the operators rely on people. As described in the advisory, they contact targets over WhatsApp or Telegram while posing either as someone the victim knows or as a technical support figure, then deliver a file and persuade the victim to run it. The payload is unpacked by a two-stage loader that displays a plausible-looking installer window, so the victim believes a normal setup is in progress while the implant installs itself behind the scenes.

Telegram doubles as command and control

The most distinctive design choice is the reporting channel: each implant communicates with a Telegram bot created for that specific victim, which then serves as its command-and-control infrastructure. Because Telegram is a mainstream service with valid certificates, defenders cannot simply block it without disrupting legitimate use, and traffic to the bot is difficult to separate from ordinary encrypted messaging. Stolen data leaves through the same channel, and the advisory also names Vultr object storage, Storj and Backblaze B2 as exfiltration destinations.

Documented capabilities and hunting clues

The advisory attributes a broad feature set to the tooling: enumerating installed programs, capturing screenshots, recording microphone audio, harvesting Telegram and WhatsApp data, extracting passwords and email saved in browsers, and fetching additional malware. One variant deletes files on the infected host. The malware does not spread on its own, so propagation depends entirely on the social-engineering approach.

Persistence is achieved through Windows registry Run keys, and the implant also registers Microsoft Defender folder exclusions to keep itself out of scanning range. Investigators flagged a hidden directory under SysWOW64 whose name ends in a trailing space, a small detail that can be folded into endpoint hunting queries. Published indicators include api.telegram.org, vultrobjects.com, storjshare.io, shturl.cc and several commercial proxy providers. Fake installers observed in the campaign imitate Pictory, KeePass, Telegram, RunwayML, Norton and Adobe Flash Player, and one lure took the form of a fabricated MRI result. The FBI has issued a FLASH bulletin on the campaign, and the dev.to report notes that the US Department of Justice seized four Iranian leak sites in March 2026.

Detection without blocking Telegram

Because blocking Telegram outright is rarely viable, defenders need narrower signals. One is behavioural: the implant embeds a unique bot token per victim, so network logs may reveal hosts contacting the Telegram API with no legitimate reason to do so. Registry changes that add Defender exclusions are another, since little legitimate software needs them and they merit an alert on their own. The trailing-space directory gives file-system hunters a concrete artifact to sweep for. The NCSC also runs a free cyber-defence service for individuals assessed as high risk, a mitigation that does not depend on installing endpoint software.

What the advisory does not say

The public record has limits. The advisory documents behaviour and indicators for the versions analysed, and newer builds may differ. It does not state victim numbers, and it does not tie specific intrusions to actors beyond the intelligence services named. The campaign timeline likewise reflects the agencies' assessment rather than an independently verified chronology.

Why it matters

The campaign shows how everyday cloud and messaging services can be repurposed as spyware infrastructure: Telegram bots, Vultr storage, Storj and Backblaze B2 are all part of normal network activity, which means perimeter blocking fails and detection has to become behavioural. For the primary target set, individuals assessed as high risk, the stakes are personal rather than corporate, since the tooling captures microphone audio, messaging history and saved passwords. The advisory's practical value lies in its concrete, low-cost detections: anomalous Telegram API traffic, Defender exclusion changes and an oddly named hidden directory are all things defenders can hunt for today.