US, UK, and Dutch cybersecurity agencies have exposed a Windows malware deployed by Iran's intelligence service to conduct surveillance on dissidents, journalists, and activists globally. The malware operates through Telegram command-and-control channels, giving operators remote access to victims' communications, files, and audio recordings.
The joint advisory identifies the malware as a tool of Iran's Ministry of Intelligence and Security (MOIS). Operators deploy the malware against high-risk targets including political opposition figures, journalists covering Iranian affairs, and human rights activists. The infection vector and initial compromise method remain undisclosed in public disclosures, though typical entry points for similar state-sponsored tools include spear-phishing emails and watering hole attacks.
Once installed on a Windows system, the malware establishes persistent access to the victim's device. It captures email traffic and instant messages from multiple communication platforms. The malware can take repeated screenshots of the victim's desktop, creating a timeline of their activities and communications. Microphone activation allows operators to record ambient audio and phone calls without the user's knowledge.
The use of Telegram as a command infrastructure represents an operational choice by Iran's MOIS. Telegram's end-to-end encryption and disappearing messages feature provide plausible deniability and reduce forensic evidence. Attackers can create private channels or bots to issue commands and receive stolen data, compartmentalizing operations across multiple accounts.
The threat extends beyond Iranian borders. Targets have appeared in Europe, North America, and the Middle East. Journalists reporting on Iranian human rights violations face heightened risk. Diaspora communities and opposition activists living in exile represent recurring victim categories. The malware's capabilities make it suitable for long-term espionage operations against individuals rather than mass surveillance.
Mitigation steps include updating Windows systems to the latest patches, disabling unnecessary microphone and camera access at the device level, and reviewing Windows Defender logs for suspicious file activity. Organizations should implement network monitoring to detect Telegram traffic patterns associated with command-and-control activity, particularly if employees access Telegram on corporate devices.
The advisory does not publicly name a specific CVE exploited by this malware, suggesting it either leverages known vulnerabilities or relies on social engineering for initial access. Recipients of the alert include law enforcement, diplomatic services, and media organizations in allied nations.
This disclosure reflects ongoing coordination between Five Eyes partners and allied intelligence services to expose Iranian cyber operations. Previous MOIS campaigns have targeted banking systems, government agencies, and infrastructure operators. This malware represents a shift toward targeted human intelligence gathering against individuals rather than institutional targets.
Users should assume that messages sent via unencrypted channels, screenshots, and microphone access represent potential exposure points if their system becomes infected. VPN usage, encrypted messaging applications, and device-level access controls provide partial mitigation but do not eliminate risk from a fully compromised endpoint.