Chosen Brick and HEAVYGRAM: Iranian Spyware That Reports Through Telegram

On 15 September 2026, the UK National Cyber Security Centre, the FBI and the Dutch AIVD published a joint advisory on Windows spyware linked to Iranian intelligence. The two families are tracked as Chosen Brick and HEAVYGRAM. The advisory states that the tooling has been in use since at least 2025, with the wider campaign dating to autumn 2023.

Delivery and staging

The operators approach targets through WhatsApp and Telegram while impersonating an acquaintance or someone offering technical support. They send a file and ask the victim to run it. The loader runs in two stages behind a convincing graphical interface, so the victim sees something that looks like a legitimate installer while the payload unpacks.
Once installed, the implant reports to a per-victim Telegram bot that acts as command and control. That choice is deliberate. Telegram is a legitimate service with valid certificates, so blocking it outright carries a cost, and the bot channel blends into ordinary encrypted traffic. Exfiltration uses the same channel alongside Vultr object storage, Storj and Backblaze B2.

Capabilities and what to hunt

The advisory lists program enumeration, screenshot capture, microphone recording, collection of Telegram and WhatsApp data, extraction of browser-stored passwords and email, and downloading additional malware. One version deletes files on the host. There is no self-propagation, so spread depends on social engineering.
Persistence is documented through registry Run keys, and the implant also adds Defender folder exclusions to protect itself. Investigators have noted a hidden SysWOW64 directory whose name carries a trailing space, a detail worth adding to endpoint hunting queries. Documented mutexes and network indicators include api.telegram.org, vultrobjects.com, storjshare.io, shturl.cc, and commercial proxy providers.
Lures observed in the campaign include Pictory, KeePass, Telegram, RunwayML, Norton, Adobe Flash Player and a fake magnetic resonance imaging result. The FBI published a FLASH document for the campaign, and the US Department of Justice seized four Iranian leak sites in March 2026.

What defenders can do

Detection cannot depend on blocking Telegram alone. Because a per-victim bot token is embedded in the implant, network logs may show requests to the Telegram API from hosts that have no business talking to it, which is a workable signal. Registry changes that add Defender exclusions deserve an alert on their own, because legitimate software rarely needs them. The hidden directory with the trailing space in its name is a useful file-system hunting clue.
High-risk individuals are the primary target set. The NCSC offers a free cyber-defence service to people assessed as high risk, which is a mitigation that does not require an endpoint agent.

Limits of the public record

The joint advisory describes the tooling and its behaviour. It does not publish victim counts or attribute specific intrusions beyond the intelligence services named. The campaign timeline reflects the agencies' assessment, and the indicators cover the versions analysed, so newer builds may differ.

References

• Joint advisory from the UK NCSC, FBI and Dutch AIVD, 15 September 2026.
• FBI FLASH-20260320-001.