Three Western intelligence agencies have jointly named and detailed a Windows malware campaign run by Iran's Ministry of Intelligence and Security — and the command-and-control channel is Telegram. That's not a metaphor. The malware literally receives its instructions through the messaging app most people associate with privacy-conscious group chats.

The advisory, published jointly by US, UK, and Dutch cybersecurity agencies, describes a tool being used to target dissidents, journalists, and activists with ties to Iran — wherever in the world they happen to live. The malware can exfiltrate emails and chat histories, take screenshots, and silently activate the device microphone to record conversations. It's a full surveillance suite dressed up as a commodity tool.

Why Telegram, and why does it matter?

Using a legitimate platform as a C2 channel is a classic technique — it blends malicious traffic in with normal app behaviour, making it much harder for network defenders to spot. Blocking Telegram wholesale isn't a realistic option for most organisations, and even deep packet inspection struggles when the traffic looks like ordinary API calls to a popular service. Iranian operators have used this approach before with other platforms, but a joint five-eyes-adjacent advisory naming the specific mechanism publicly is unusual, and signals the agencies believe the activity has reached a scale worth calling out.

The lures are reportedly personalised and convincing. The Record notes one documented case where attackers sent fake MRI scan results to a target — the kind of tailored social engineering that implies prior surveillance or open-source research on victims. This isn't spray-and-pray phishing; it's targeted harassment with state backing.

The broader pattern

Iran's cyber operations have matured significantly over the last decade. Where once the focus was on disruptive attacks — think the Shamoon wiper — the Islamic Revolutionary Guard Corps and MOIS have increasingly invested in persistent surveillance capabilities designed to track and intimidate the Iranian diaspora. Joint advisories like this one reflect a shift in how Western governments are responding: naming the tool, naming the actor, and giving defenders a fighting chance.

For Australian readers, the ACSC has previously warned that Iranian cyber actors actively target diaspora communities, journalists, and human rights advocates in Western countries including Australia. The Iranian community in Melbourne and Sydney is significant, and the kind of targeted surveillance described here — fake medical documents, credential theft, microphone activation — is precisely the threat model ASIO has flagged in its annual threat assessments for the last three years.

What defenders should do

The advisory's technical indicators — file hashes, Telegram bot IDs, and network signatures — are worth operationalising immediately if you work with at-risk communities, NGOs, or media organisations. More broadly, this is a reminder that threat models for civil society organisations are genuinely different from corporate ones. The attacker isn't after your intellectual property. They're after the person.

Patch Windows. Enable application control. And if your at-risk users are still using Windows with no endpoint visibility, that's the most urgent conversation to have this week.