fbi says iranian

FBI says Iranian hackers are using Telegram to steal data in malware attacks

Iranian government hackers are using Telegram as a way to steal data from hacked dissidents, opposition groups, and journalists who oppose the regime around the world, according to an FBI alert published on Friday.  

In the first stage of the attack, the hackers contact their targets and pretend to be a known contact or tech support, and are tricked into accepting a link to a malicious file masquerading as legitimate apps, such as Telegram and WhatsApp. Once the target installs the malware, the second stage of the attack connects the infected victim with Telegram bots that allow the hackers to remotely command and control the victim’s computer. This allows the hackers to gain remote control of victims’ devices to steal files, take screenshots, and record Zoom calls, according to the FBI. 

Using Telegram as a way to remotely control a victim’s device is a common technique by hackers to hide malicious activity among legitimate network traffic, which makes it harder for cybersecurity defenders and anti-malware products to identify.

According to the FBI, the hackers responsible for these attacks are allegedly working for Iran’s Ministry of Intelligence and Security (MOIS). The FBI said these attacks are an example of Iranian government hackers’ attempts to push the regime’s “geopolitical agenda.”

Contact Us

Do you have more information about Handala, or other Iran-linked hacking operations? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or by email.

In the alert, the FBI mentioned the pro-Iranian and pro-Palestinian fake hacktivist group Handala, although it’s not clear if the attacks referenced in the alert were carried out by this group. 

Earlier this month, Handala claimed responsibility for an attack on medical tech giant Stryker, which resulted in wiping tens of thousands of employee devices.

In an 8-K filing with the U.S. Securities and Exchange Commission on Monday, Stryker said it is still recovering from the hack.


Last week, the U.S. Justice Department accused Handala of being a front for Iran’s government, specifically the MOIS, and for being behind the Stryker hack. At the same time, the FBI took down and seized two websites linked to Handala, and two other sites linked to another Iranian hacktivist group called “Homeland Justice.” In the recent FBI alert, the bureau said the two groups are linked and controlled by the MOIS. 

An FBI spokesperson said in an email that the bureau “has nothing additional to add.”

Telegram’s spokesperson Remi Vaughn said that the platform’s “moderators routinely remove any accounts found to be involved with malware.”

Updated to include the FBI’s and Telegram’s response.

Similar Posts

  • | |

    Iran pressures Gulf allies to rein in Trump, threa…

    Iran has launched an intensive diplomatic campaign targeting Gulf states, warning them directly that Tehran will strike their oil, power and water facilities unless they persuade President Donald Trump to halt US military action and pursue a negotiated end to the war instead. According to a senior Iranian official, the warning covers potential attacks on energy facilities, oil fields, refineries, electricity grids, water systems, transport networks and other strategic infrastructure belonging to Washington’s closest Arab partners in the region. The message formed part of a wider Iranian strategy to discourage further American military action by raising the specter of significant economic damage across the Gulf. Sources familiar with the matter said the warning traveled through a wave of high level diplomatic contacts following Trump’s July 28 threat to strike Iran’s energy network and broader infrastructure. Two senior Iranian officials, two Gulf sources and a senior regional diplomat, all speaking on condition of anonymity given the sensitivity of the discussions, said Iranian Foreign Minister Abbas Araqchi held conversations with his Saudi, Turkish and Qatari counterparts as well as Pakistan’s army chief. The senior diplomat said Araqchi pressed Washington’s Gulf allies to use their influence with Trump to head off renewed strikes, cautioning that any attack on Iran would trigger retaliation against American assets and critical infrastructure throughout the Gulf. The diplomat said Araqchi delivered a consistent message in each conversation, expressing readiness to retaliate while stressing that a diplomatic solution offers the best chance of avoiding wider regional destruction. One Gulf source described the Iranian position as unambiguous, saying Tehran made clear that any American strike on Iranian infrastructure would draw retaliation against Gulf energy facilities and other regional targets. The campaign illustrates how Iran is attempting to convert Gulf vulnerability into diplomatic leverage, presenting regional governments with the prospect that a renewed confrontation between Washington and Tehran could put the infrastructure their economies depend on directly at risk. Saudi Crown Prince Mohammed bin Salman subsequently spoke with Trump directly, urging him to hold off on military action, return to the negotiating table, pursue a ceasefire and seek a diplomatic resolution, according to the senior diplomat and Gulf sources. Another Gulf source said the warning was meant for every Gulf state but traveled primarily through Saudi Arabia and Qatar, both of which have rebuilt ties with Iran in recent years after a long period of regional rivalry. Qatar, Oman and Saudi Arabia have each urged Washington to resume talks with Tehran and prevent a fresh round of conflict, with Iran cautioning that further strikes could turn the region into what one Iranian official called a fireball. On August 2, Trump said he had agreed to call off a planned attack on Iran, provided a deal could be reached quickly. Concerns over wider escalation A Gulf source said Saudi Arabia believes additional escalation would only cause further destruction, explaining why Riyadh pushed Trump to give diplomacy more room to work. At the same time, Saudi officials made clear the kingdom would defend itself if directly threatened, with a second Gulf source saying Riyadh warned that any strike on Saudi territory would draw a military response of its own. Ali Shihabi, a Saudi analyst with ties to the royal court, said the kingdom’s assessment holds that further escalation is unlikely to produce the outcome Washington wants. He said Saudi officials believe a mix of proportionate military responses combined with sustained pressure on Iran around the Strait of Hormuz offers the most realistic route toward a workable diplomatic settlement. Iran’s clerical leadership has repeatedly called for the closure of US military bases across the Gulf and urged Gulf Arab states to stop sharing intelligence with Washington, which Tehran believes has enabled strikes against Iranian targets. Shihabi noted that memories of the September 2019 drone and missile strikes on Saudi Arabia’s Abqaiq and Khurais oil facilities still shape regional thinking, since that attack temporarily cut more than half the kingdom’s crude output and exposed how vulnerable Gulf energy infrastructure remains. A separate Iranian official reiterated that any damage inflicted on Iran would be met with far greater retaliation, again citing power grids and refineries among potential targets. From Tehran’s perspective, the senior Iranian official said, Trump now confronts two difficult options: escalate a conflict that risks engulfing the wider Gulf and disrupting global energy markets, or accept a negotiated settlement that falls short of the decisive win Washington has sought. The senior regional diplomat identified Washington’s reluctance to let Tehran claim any form of victory as one of the central obstacles blocking an agreement, noting that American officials want tangible proof they prevailed in the conflict.

  • | |

    Watch Flock Safety CEO Garrett Langley discuss the future of surveillance at TechCrunch Disrupt 2026

    Flock Safety sits right at the center of the debate over where the line should be drawn between privacy and public safety. That’s why we’re bringing Flock’s founder and CEO Garrett Langley to the stage to speak about those very issues.

Leave a Reply

Your email address will not be published. Required fields are marked *