Iranian Telegram-Controlled Spyware Targeting Dissidents and Journalists: Detection and Defense Guide

Cybersecurity agencies from the United States, the United Kingdom, and the Netherlands have jointly detailed a Windows spyware family attributed to Iran's Ministry of Intelligence and Security (MOIS). The malware is being used in an active, ongoing campaign to surveil dissidents, journalists, and activists worldwide — and its command-and-control (C2) channel is the Telegram messaging platform.

This is not a theoretical threat. This is a confirmed, in-the-wild espionage tool deployed against civil society targets. If your organization employs journalists, activists, diaspora community members, NGO staff, or anyone who could be of interest to Iranian intelligence, your endpoints are in scope. Even for enterprises outside the traditional target set, the tradecraft here — legitimate messaging platforms abused as C2 — is a pattern every SOC needs to detect, because it is increasingly shared across state and criminal actors.

The use of Telegram as C2 is the critical defensive detail. It means the malware blends its command traffic into encrypted connections to a legitimate, widely-used service. Domain-blocking alone won't save you if Telegram is permitted in your environment. Behavioral detection is the answer.

Technical Analysis

What the Malware Does

Per the joint agency reporting, the Windows malware provides operators with a full surveillance toolkit:

• Email and chat message theft — harvesting mailbox content and messaging application data from the infected host
• Screenshot capture — taking images of the victim's screen, a classic espionage capability (MITRE ATT&CK T1113)
• Microphone activation and audio recording — turning the endpoint into a room bug (T1123)
• Telegram-based C2 — operators issue commands and receive exfiltrated data through the Telegram messaging app, almost certainly via the Telegram Bot API (T1102 — Web Service; T1571 — Non-Standard Port is less likely here since Telegram uses standard HTTPS/443)

The Attack Chain (Defender's View)

Based on the described capabilities, the intrusion lifecycle looks like this:

1. Initial access — Iranian state actors historically rely on spear phishing and social engineering against civil society targets (T1566). Expect highly personalized lures in Persian/Farsi and English, often impersonating journalists, conference organizers, or colleagues.
2. Execution and staging — a Windows executable or script-based loader is run by the victim or via a malicious document.
3. C2 establishment — the implant initiates outbound HTTPS connections to Telegram infrastructure, most likely api.telegram.org, polling for operator commands from a bot or channel.
4. Collection — on command, the malware captures screenshots, records microphone audio, and enumerates/stages email and chat data (Outlook OST/PST files, browser-stored sessions, messaging app databases).
5. Exfiltration — collected data is sent back through the same Telegram channel, masquerading as ordinary app traffic.

Why Telegram C2 Defeats Naive Defenses

• Traffic is TLS-encrypted to a reputable domain with a massive legitimate user base.
• The Bot API (api.telegram.org/bot<token>/<method>) is a documented, legitimate interface — connection metadata alone looks benign.
• Many environments allow Telegram for legitimate communications, so a blanket block may not be politically or operationally feasible.

The discriminator is which process is talking to Telegram. The legitimate Telegram Desktop client is Telegram.exe (typically under %APPDATA%\Telegram Desktop or installed via the Microsoft Store). A random unsigned binary in %TEMP%, %APPDATA% with a random name, a rundll32.exe/powershell.exe instance, or any process with no business using a messaging API connecting to api.telegram.org is a high-fidelity indicator.

Exploitation Status

• Attribution: Iran's Ministry of Intelligence and Security (MOIS), per joint US/UK/NL agency reporting.
• Status: Confirmed active, in-the-wild espionage campaign targeting dissidents, journalists, and activists globally.
• No CVE is associated with this reporting — this is a malware/TTP advisory, not a vulnerability disclosure. Do not look for a patch; look for the behavior.

Detection & Response

The detections below focus on the two highest-fidelity behavioral discriminators: (1) non-Telegram processes communicating with Telegram API infrastructure, and (2) surveillance behaviors (screen capture and audio recording) initiated by unusual processes.

Sigma Rules

---
title: Non-Telegram Process Connecting to Telegram API
description: Detects processes other than the legitimate Telegram Desktop client establishing network connections to Telegram API infrastructure, consistent with Telegram-bot-based C2 used by Iranian state spyware.
references:
  - https://thehackernews.com/2026/09/iranian-hackers-use-telegram-controlled.html
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/09/15
status: experimental
tags:
  - attack.command_and_control
  - attack.t1102
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'api.telegram.org'
      - 'core.telegram.org'
      - 't.me'
  filter_legit_client:
    Image|endswith:
      - '\Telegram.exe'
  condition: selection and not filter_legit_client
falsepositives:
  - Third-party Telegram clients (Unigram, Telegram CLI wrappers)
  - Legitimate automation scripts using Telegram bots for alerting
level: high
---
title: Suspicious Process Initiating Audio Capture
description: Detects processes known to be abused as LOLBins or script hosts accessing microphone/audio capture devices, consistent with the audio surveillance capability of Telegram-controlled spyware.
references:
  - https://thehackernews.com/2026/09/iranian-hackers-use-telegram-controlled.html
  - https://attack.mitre.org/techniques/T1123/
author: Security Arsenal
date: 2026/09/15
status: experimental
tags:
  - attack.collection
  - attack.t1123
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|contains: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\Global\\{E5323777-F976-4f5b-9B55-B94699C46E44}'
    Details|contains: 'Allow'
  condition: selection
falsepositives:
  - Users granting microphone access to legitimate conferencing apps (Teams, Zoom)
level: medium
---
title: Screen Capture Via PowerShell or .NET Reflection
description: Detects command lines consistent with programmatic screenshot capture using .NET System.Drawing or CopyFromScreen, a technique used by commodity and state spyware for screen surveillance.
references:
  - https://thehackernews.com/2026/09/iranian-hackers-use-telegram-controlled.html
  - https://attack.mitre.org/techniques/T1113/
author: Security Arsenal
date: 2026/09/15
status: experimental
tags:
  - attack.collection
  - attack.t1113
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'CopyFromScreen'
      - 'System.Drawing.Bitmap'
      - 'Graphics.CopyFromScreen'
      - '[System.Windows.Forms.SystemInformation]::VirtualScreen'
  condition: selection
falsepositives:
  - Legitimate IT automation or RMM screenshot tooling
level: high

KQL — Microsoft Sentinel / Defender

This hunt identifies endpoints where a non-Telegram process has communicated with Telegram API infrastructure, and enriches with process lineage so analysts can quickly triage the parent-child chain.

// Hunt: Non-Telegram processes communicating with Telegram API infrastructure
// Relevant to Telegram-bot C2 used by Iranian state spyware
let TelegramHosts = dynamic(["api.telegram.org", "core.telegram.org", "t.me", "telegram.org", "cdn.telegram.org"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl in~ (TelegramHosts) or RemoteUrl has "telegram"
| where FileName !~ "Telegram.exe"
| join kind=leftouter (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | project DeviceId, FileName, ProcessCommandLine, ProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, ProcessCreationTime
) on DeviceId, FileName
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), ConnectionCount = count(), RemoteIPs = make_set(RemoteIP), RemoteUrls = make_set(RemoteUrl)
    by DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by ConnectionCount desc

If you ingest Sysmon/network telemetry via Syslog or CommonSecurityLog rather than Defender, pivot on the same hostnames against those tables.

Velociraptor VQL

This artifact hunts live endpoints for processes with active connections to Telegram infrastructure and pulls the executable path and signer status for rapid triage — useful when you need to sweep a fleet for implant activity without waiting for EDR telemetry to age in.

-- Hunt for processes with active connections to Telegram infrastructure
-- Excludes the legitimate Telegram Desktop client
SELECT Pid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE Pid IN (
    SELECT Pid FROM netstat()
    WHERE (RemoteIP =~ '149.154' OR RemoteIP =~ '91.108')  -- Telegram published AS62041/AS59930 ranges
      AND Status = 'ESTABLISHED'
)
  AND NOT Exe =~ '(?i)Telegram\\\\Telegram.exe'

Note: Telegram's infrastructure primarily lives in 149.154.160.0/20 and 91.108.0.0/16. Validate these ranges against current Telegram ASN data before broad deployment, and pair this with a DNS-based hunt for api.telegram.org where possible.

Remediation / Triage Script — PowerShell

Run this on suspected endpoints (or deploy via your RMM/GPO startup script for a sweep) to enumerate recent connections to Telegram infrastructure by non-Telegram processes, flag unsigned executables in user-writable locations, and audit microphone privacy consent settings.

# Iranian Telegram-C2 Spyware Triage Script — Security Arsenal
# Run elevated. Outputs findings to console and C:\IR-Triage\TelegramC2-Triage-<hostname>.txt

$outDir = "C:\IR-Triage"
New-Item -Path $outDir -ItemType Directory -Force | Out-Null
$log = Join-Path $outDir ("TelegramC2-Triage-" + $env:COMPUTERNAME + ".txt")

"=== Telegram C2 Triage — $(Get-Date -Format o) ===" | Tee-Object $log

# 1. Recent network connections to Telegram infrastructure
"`n[1] Processes with connections to Telegram IP ranges (149.154.0.0/16, 91.108.0.0/16):" | Tee-Object $log -Append
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object {
    $_.RemoteAddress -match '^(149\.154|91\.108)\.'
}
foreach ($c in $conns) {
    $p = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    if ($p -and $p.Path -notmatch 'Telegram\\Telegram\.exe$') {
        $sig = Get-AuthenticodeSignature -FilePath $p.Path -ErrorAction SilentlyContinue
        "PID $($c.OwningProcess) | $($p.ProcessName) | $($p.Path) | Remote $($c.RemoteAddress):$($c.RemotePort) | SigStatus: $($sig.Status)" | Tee-Object $log -Append
    }
}

# 2. Unsigned executables in user-writable locations
"`n[2] Unsigned executables in user-writable paths:" | Tee-Object $log -Append
$paths = @("$env:APPDATA", "$env:LOCALAPPDATA\Temp", "$env:TEMP")
foreach ($path in $paths) {
    Get-ChildItem -Path $path -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
        $s = Get-AuthenticodeSignature -FilePath $_.FullName -ErrorAction SilentlyContinue
        if ($s.Status -ne 'Valid') {
            "UNSIGNED/INVALID: $($_.FullName) | Modified: $($_.LastWriteTime)" | Tee-Object $log -Append
        }
    }
}

# 3. Microphone access consent audit
"`n[3] Microphone device-access consent setting (Allow = apps may use mic):" | Tee-Object $log -Append
$micKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{E5323777-F976-4f5b-9B55-B94699C46E44}'
$micVal = (Get-ItemProperty -Path $micKey -Name Value -ErrorAction SilentlyContinue).Value
"Microphone access: $micVal" | Tee-Object $log -Append

# 4. Recent Run-key persistence entries pointing to user paths
"`n[4] Persistence check — Run keys referencing user-writable paths:" | Tee-Object $log -Append
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
    Get-ItemProperty -Path $k -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | ForEach-Object {
        $v = (Get-ItemProperty -Path $k -Name $_.Name -ErrorAction SilentlyContinue).($_.Name)
        if ($v -match 'AppData|Temp|Users\\') { "[$k] $($_.Name) = $v" | Tee-Object $log -Append }
    }
}

"`n=== Triage complete. Review $log and escalate any hits to IR. ===" | Tee-Object $log -Append

Remediation

There is no patch for this threat — it is malware, not a vulnerability. Remediation is about detection, containment, and hardening:

1. Identify and protect the target population. If your organization employs journalists, activists, NGO workers, or Iranian diaspora staff, treat their endpoints as elevated-risk assets. Enroll them in enhanced monitoring, enforce phishing-resistant MFA (FIDO2/passkeys) on email and messaging accounts, and brief them on the spear-phishing tradecraft Iranian actors use — highly personalized, often impersonating media contacts or professional opportunities.
2. Contain confirmed infections. Isolate the host from the network (EDR network isolation, not just unplugging — you want memory intact for forensics). Assume full credential compromise on that host: reset all credentials accessible from it, revoke sessions/tokens for email and messaging accounts, and rotate any API keys stored locally.
3. Restrict Telegram Bot API access where not needed. If Telegram is not a business tool, block api.telegram.org, *.telegram.org, and *.t.me at the proxy/DNS layer. If Telegram is permitted, implement TLS inspection and alerting on non-Telegram processes reaching API endpoints, per the detections above.
4. Deploy application control. AppLocker or Windows Defender Application Control (WDAC) policies blocking unsigned executables in user-writable directories (%APPDATA%, %TEMP%, %LOCALAPPDATA%) will stop a large class of implant staging.
5. Control surveillance capabilities. Use Group Policy or MDM to restrict microphone and camera access to approved applications (the privacy consent keys under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess). Consider disabling microphone access by default for high-risk user populations.
6. Harden email and messaging data at rest. The malware copies emails and chat messages — enforce full-disk encryption (BitLocker), disable cached Exchange mode retention beyond policy minimums on high-risk endpoints, and encourage use of disappearing-message features on sensitive communications.
7. Monitor for the behavior, not the hash. Iranian state actors recompile frequently. Hash-based IOCs will age out in days; the behavioral detections above (non-Telegram process → Telegram API; surveillance APIs invoked by unusual processes) are durable.
8. Review the joint agency reporting. Pull the full technical advisories from CISA, the UK NCSC, and the Dutch NCSC/AIVD for any published file paths, mutexes, or registry artifacts, and fold them into your EDR watchlists.

The Bottom Line

Telegram-as-C2 is not new, but its use by Iranian intelligence against journalists and dissidents — now formally called out by three allied governments — should push every defender to answer one question: can I tell the difference between the Telegram app and a Telegram-controlled implant on my endpoints? If the answer is no, the detections above are your starting point. Behavioral discrimination of process-to-destination relationships is table stakes for modern SOC work, and this campaign is exactly why.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub