Iran-linked actors use Telegram as C2 in malware attacks on dissidents

The FBI alert describes Iran-linked Ministry of Intelligence and Security (MOIS) cyber campaigns that employ social engineering and multi-stage malware—masquerading as legitimate apps—to compromise Windows systems of dissidents, journalists, and opposition figures. Infected hosts install persistent implants that use Telegram bots (api.telegram.org) for bidirectional C2, enabling screen and audio capture, file collection/compression, and exfiltration; the report includes example malware filenames and urges standard mitigations (patching, trusted sources, AV, MFA, reporting).