FBI says Iranian hackers are using Telegram to steal data in malware attacks

According to a recent alert from the FBI, Iranian state-sponsored hackers are leveraging the messaging platform Telegram to infiltrate and steal sensitive information from dissidents, opposition groups, and journalists critical of the Iranian regime globally. The initial phase of these cyberattacks involves the hackers reaching out to potential victims, masquerading as trusted contacts or technical support representatives. They deceive targets into clicking links that lead to malicious files disguised as legitimate applications, including Telegram and WhatsApp. Once these harmful applications are installed, the second phase of the attack allows the perpetrators to connect the compromised devices to Telegram bots, granting them remote access and control. With this access, hackers can monitor victims' activities, steal files, take screenshots, and even record conversations on platforms like Zoom, as detailed by the FBI. By utilizing Telegram, these malicious actors can hide their activities among regular network traffic, complicating detection efforts by cybersecurity professionals and anti-malware tools. The FBI attributes these attacks to hackers affiliated with Iran’s Ministry of Intelligence and Security (MOIS), highlighting a broader strategy to further the regime's geopolitical objectives. The alert also references the pro-Iranian hacktivist group Handala, although it remains uncertain whether they were directly involved in the recent attacks. Earlier this month, Handala claimed responsibility for a significant cyberattack on the medical technology firm Stryker, which resulted in the erasure of thousands of employee devices. In a recent filing with the U.S. Securities and Exchange Commission, Stryker acknowledged that it is still in the recovery process following the breach. Simultaneously, the U.S. Justice Department has implicated Handala as a proxy for the Iranian government, specifically linking it to the MOIS and the Stryker incident. In a related move, the FBI has taken steps to dismantle and seize websites associated with Handala, as well as other Iranian hacktivist groups, underscoring the connections between these entities and the Iranian government. Efforts to gather more information from the FBI and Telegram regarding these incidents have not yielded responses as of yet.